<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="203">
<package pkgid="b457c09045bda1d1601accc6add39b0db32e4bbb0fe1fe2f5156bc4d670c4313" name="kernel-rt" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.10.1.el9_8.0.1"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.3.1.el9_8]" date="1774008000">- HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818}
- NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415]
- perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340]
- perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340]
- perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340]
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193}
- nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552]
- redhat: genlog: add new JIRA cloud server hostname (Jan Stancek)
- gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055]
- io_uring: graduate to full support (Jeff Moyer) [RHEL-120699]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231}
- net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180}
- net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424]
- macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227]
- macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209}
- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814]
- migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.4.1.el9_8]" date="1774612800">- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144}
- ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365]
- libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611]
- libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611]
- libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611]
- libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611]
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611]
- libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611]
- redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611]
- redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611]
- crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611]
- ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210}
- smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396]
- wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.5.1.el9_8]" date="1775044800">- kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672]
- kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672]
- RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243}
- net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109}
- iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.6.1.el9_8]" date="1776340800">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402}
- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741}
- smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988]
- ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378]
- RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966]
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207]
- ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095]
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.10.1" date="1779278400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@resf.org&gt; - 5.14.0-687.10.1.0.1" date="1779537600">- Bump release for rebuild with updated rocky-sb-certs</changelog>
</package>
<package pkgid="59ef8b379f4ed8cd5db6652afd5c93b268263d5897096ff6ccbfdf89e11f33cf" name="kernel-rt" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.12.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.4.1.el9_8]" date="1774612800">- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144}
- ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365]
- libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611]
- libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611]
- libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611]
- libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611]
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611]
- libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611]
- redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611]
- redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611]
- crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611]
- ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210}
- smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396]
- wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.5.1.el9_8]" date="1775044800">- kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672]
- kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672]
- RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243}
- net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109}
- iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.6.1.el9_8]" date="1776340800">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402}
- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741}
- smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988]
- ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378]
- RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966]
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207]
- ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095]
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.11.1.el9_8]" date="1779192000">- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
- ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
- ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
- ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
- ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
- ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
- ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
- nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
- x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
- ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
- ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
- Revert "mm: pcp: increase pcp-&gt;free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.12.1.el9_8]" date="1779710400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.12.1" date="1779969600">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="f9016db6aa0ee6ca368646f06a05ac28b26f511e0961f046e702ab9f0e944093" name="kernel-rt" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.15.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.11.1.el9_8]" date="1779192000">- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
- ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
- ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
- ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
- ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
- ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
- ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
- nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
- x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
- ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
- ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
- Revert "mm: pcp: increase pcp-&gt;free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.12.1.el9_8]" date="1779710400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.13.1.el9_8]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243}
- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472]
- nvme: nvme-fc: Ensure -&gt;ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786}
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167]
- crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613}
- mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778]
- mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778]
- mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778]
- mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778]
- mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778]
- mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778]
- mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778]</changelog>
  <changelog author="Tanishi Srivastava &lt;tsrivast@redhat.com&gt; [5.14.0-687.14.1.el9_8]" date="1781006400">- RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181}
- redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501}
- RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852}
- netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116}
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526]
- ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336]
- ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336]
- ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336]
- dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938]
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056}
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216}
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419}
- x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.15.1.el9_8]" date="1781092800">- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037}
- net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.15.1" date="1781179200">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="73c8305cd5a296267ff028efb83c6b56b4ce044ad5a8c61aca69e07806103e04" name="kernel-rt" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.24.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.16.1.el9_8]" date="1781611200">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308]
- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048]
- gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056}
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699]
- mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175820]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.24.1" date="1783598400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="c5b1383200e190e3fb41d366c4a5b8c6587d290aee098ccf23a632827c2bc23d" name="kernel-rt" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.25.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.25.1" date="1783944000">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="cbe283ac6effaa09eb4678ca8ca32f098347636a552d2685786729c5ce10e3ec" name="kernel-rt" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.26.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.26.1.el9_8]" date="1783944000">- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.26.1" date="1784030400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="82865899b2f94c7f339120284102944e61fd40a98a735344b26d3807a1901db1" name="kernel-rt" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.29.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [5.14.0-687.26.1.el9_8]" date="1784030400">- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.27.1.el9_8]" date="1784203200">- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886]
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113}
- crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943]
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110}
- net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121]
- net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121]
- net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121]
- net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121]
- net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121]
- net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121]
- net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121]
- net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121]
- net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121]
- net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121]
- net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix deadlock between devlink lock and esw-&gt;wq (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121]
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121]
- net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121]
- net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121]
- net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121]
- IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121]
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071}
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980]
- libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.28.1.el9_8]" date="1784548800">- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.29.1.el9_8]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685]
- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061]
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099}
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.29.1" date="1784721600">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="72f2d95796088cbdf076f04866abac7bbf28068b5bae2ffba2829fe042f2317b" name="kernel-rt-64k" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.10.1.el9_8.0.1"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.3.1.el9_8]" date="1774008000">- HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818}
- NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415]
- perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340]
- perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340]
- perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340]
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193}
- nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552]
- redhat: genlog: add new JIRA cloud server hostname (Jan Stancek)
- gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055]
- io_uring: graduate to full support (Jeff Moyer) [RHEL-120699]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231}
- net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180}
- net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424]
- macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227]
- macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209}
- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814]
- migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.4.1.el9_8]" date="1774612800">- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144}
- ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365]
- libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611]
- libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611]
- libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611]
- libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611]
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611]
- libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611]
- redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611]
- redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611]
- crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611]
- ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210}
- smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396]
- wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.5.1.el9_8]" date="1775044800">- kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672]
- kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672]
- RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243}
- net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109}
- iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.6.1.el9_8]" date="1776340800">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402}
- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741}
- smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988]
- ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378]
- RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966]
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207]
- ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095]
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.10.1" date="1779278400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@resf.org&gt; - 5.14.0-687.10.1.0.1" date="1779537600">- Bump release for rebuild with updated rocky-sb-certs</changelog>
</package>
<package pkgid="907e25f4a917a8a0a8e85abedb01a8f08e8369ae3e6e2a914c30079c296a28ee" name="kernel-rt-64k" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.12.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.4.1.el9_8]" date="1774612800">- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144}
- ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365]
- libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611]
- libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611]
- libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611]
- libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611]
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611]
- libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611]
- redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611]
- redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611]
- crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611]
- ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210}
- smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396]
- wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.5.1.el9_8]" date="1775044800">- kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672]
- kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672]
- RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243}
- net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109}
- iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.6.1.el9_8]" date="1776340800">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402}
- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741}
- smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988]
- ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378]
- RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966]
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207]
- ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095]
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.11.1.el9_8]" date="1779192000">- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
- ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
- ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
- ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
- ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
- ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
- ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
- nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
- x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
- ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
- ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
- Revert "mm: pcp: increase pcp-&gt;free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.12.1.el9_8]" date="1779710400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.12.1" date="1779969600">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="23c0080e9902a49b242032294557acdebe696b94993e5715929f350da382144e" name="kernel-rt-64k" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.15.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.11.1.el9_8]" date="1779192000">- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
- ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
- ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
- ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
- ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
- ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
- ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
- nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
- x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
- ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
- ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
- Revert "mm: pcp: increase pcp-&gt;free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.12.1.el9_8]" date="1779710400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.13.1.el9_8]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243}
- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472]
- nvme: nvme-fc: Ensure -&gt;ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786}
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167]
- crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613}
- mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778]
- mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778]
- mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778]
- mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778]
- mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778]
- mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778]
- mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778]</changelog>
  <changelog author="Tanishi Srivastava &lt;tsrivast@redhat.com&gt; [5.14.0-687.14.1.el9_8]" date="1781006400">- RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181}
- redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501}
- RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852}
- netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116}
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526]
- ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336]
- ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336]
- ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336]
- dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938]
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056}
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216}
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419}
- x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.15.1.el9_8]" date="1781092800">- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037}
- net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.15.1" date="1781179200">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="ea69ea67f7b1887fa650540f2181402fb00a92a44a5fe17f5876121427d1dc8a" name="kernel-rt-64k" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.17.1.el9_8"/>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.11.1.el9_8]" date="1779192000">- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
- ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
- ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
- ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
- ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
- ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
- ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
- nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
- x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
- ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
- ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
- Revert "mm: pcp: increase pcp-&gt;free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.12.1.el9_8]" date="1779710400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.13.1.el9_8]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243}
- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472]
- nvme: nvme-fc: Ensure -&gt;ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786}
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167]
- crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613}
- mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778]
- mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778]
- mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778]
- mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778]
- mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778]
- mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778]
- mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778]</changelog>
  <changelog author="Tanishi Srivastava &lt;tsrivast@redhat.com&gt; [5.14.0-687.14.1.el9_8]" date="1781006400">- RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181}
- redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501}
- RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852}
- netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116}
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526]
- ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336]
- ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336]
- ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336]
- dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938]
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056}
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216}
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419}
- x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.15.1.el9_8]" date="1781092800">- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037}
- net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.16.1.el9_8]" date="1781611200">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308]
- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048]
- gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056}
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699]
- mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175820]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.17.1" date="1782216000">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="26408de91ea838d3c9816a3c40cde0c768987e797a2213d6266942e7a3d22e77" name="kernel-rt-64k" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.22.1.el9_8"/>
  <changelog author="Tanishi Srivastava &lt;tsrivast@redhat.com&gt; [5.14.0-687.14.1.el9_8]" date="1781006400">- RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181}
- redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501}
- RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852}
- netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116}
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526]
- ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336]
- ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336]
- ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336]
- dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938]
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056}
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216}
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419}
- x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.15.1.el9_8]" date="1781092800">- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037}
- net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.16.1.el9_8]" date="1781611200">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308]
- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048]
- gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056}
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699]
- mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175820]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.22.1" date="1783339201">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="831a2b0f33bb32d3ce41cf897117ac2a044ce24f8d97308db5deec2804094160" name="kernel-rt-64k" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.24.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.16.1.el9_8]" date="1781611200">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308]
- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048]
- gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056}
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699]
- mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175820]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.24.1" date="1783598400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="196b44dfda092a4510fd894da0185c1c3f900b7a7ccec60fc4b85cccb148e6de" name="kernel-rt-64k" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.25.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.25.1" date="1783944000">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="247aa5ba5eff77a90f3331db4092cfc47dfcd14ff9afed647230d4d720c8e16a" name="kernel-rt-64k" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.26.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.26.1.el9_8]" date="1783944000">- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.26.1" date="1784030400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="5cf3ad3a72960e09521a3ca552df87664c63e77682ef5a21761985f42986c7d8" name="kernel-rt-64k" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.29.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [5.14.0-687.26.1.el9_8]" date="1784030400">- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.27.1.el9_8]" date="1784203200">- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886]
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113}
- crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943]
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110}
- net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121]
- net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121]
- net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121]
- net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121]
- net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121]
- net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121]
- net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121]
- net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121]
- net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121]
- net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121]
- net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix deadlock between devlink lock and esw-&gt;wq (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121]
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121]
- net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121]
- net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121]
- net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121]
- IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121]
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071}
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980]
- libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.28.1.el9_8]" date="1784548800">- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.29.1.el9_8]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685]
- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061]
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099}
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.29.1" date="1784721600">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="2f18b2449fd9da19153d35a5698984543a99a48d88569463f711f0e1b3ad6af2" name="kernel-rt-64k-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.10.1.el9_8.0.1"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.3.1.el9_8]" date="1774008000">- HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818}
- NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415]
- perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340]
- perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340]
- perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340]
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193}
- nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552]
- redhat: genlog: add new JIRA cloud server hostname (Jan Stancek)
- gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055]
- io_uring: graduate to full support (Jeff Moyer) [RHEL-120699]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231}
- net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180}
- net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424]
- macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227]
- macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209}
- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814]
- migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.4.1.el9_8]" date="1774612800">- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144}
- ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365]
- libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611]
- libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611]
- libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611]
- libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611]
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611]
- libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611]
- redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611]
- redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611]
- crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611]
- ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210}
- smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396]
- wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.5.1.el9_8]" date="1775044800">- kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672]
- kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672]
- RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243}
- net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109}
- iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.6.1.el9_8]" date="1776340800">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402}
- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741}
- smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988]
- ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378]
- RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966]
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207]
- ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095]
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.10.1" date="1779278400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@resf.org&gt; - 5.14.0-687.10.1.0.1" date="1779537600">- Bump release for rebuild with updated rocky-sb-certs</changelog>
</package>
<package pkgid="32747b4af1a9928aad514afcf0e60cc52ca6b6f82036b0101b5ff3e3ffeab3bc" name="kernel-rt-64k-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.12.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.4.1.el9_8]" date="1774612800">- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144}
- ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365]
- libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611]
- libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611]
- libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611]
- libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611]
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611]
- libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611]
- redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611]
- redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611]
- crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611]
- ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210}
- smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396]
- wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.5.1.el9_8]" date="1775044800">- kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672]
- kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672]
- RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243}
- net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109}
- iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.6.1.el9_8]" date="1776340800">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402}
- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741}
- smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988]
- ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378]
- RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966]
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207]
- ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095]
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.11.1.el9_8]" date="1779192000">- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
- ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
- ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
- ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
- ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
- ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
- ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
- nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
- x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
- ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
- ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
- Revert "mm: pcp: increase pcp-&gt;free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.12.1.el9_8]" date="1779710400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.12.1" date="1779969600">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="ad4726860f1775a99a7d4ab83b4dafec508214bf2ca2771373fd9f7b0f5e9416" name="kernel-rt-64k-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.15.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.11.1.el9_8]" date="1779192000">- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
- ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
- ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
- ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
- ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
- ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
- ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
- nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
- x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
- ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
- ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
- Revert "mm: pcp: increase pcp-&gt;free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.12.1.el9_8]" date="1779710400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.13.1.el9_8]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243}
- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472]
- nvme: nvme-fc: Ensure -&gt;ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786}
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167]
- crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613}
- mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778]
- mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778]
- mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778]
- mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778]
- mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778]
- mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778]
- mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778]</changelog>
  <changelog author="Tanishi Srivastava &lt;tsrivast@redhat.com&gt; [5.14.0-687.14.1.el9_8]" date="1781006400">- RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181}
- redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501}
- RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852}
- netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116}
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526]
- ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336]
- ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336]
- ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336]
- dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938]
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056}
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216}
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419}
- x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.15.1.el9_8]" date="1781092800">- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037}
- net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.15.1" date="1781179200">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="bb95b357a3f7835c52e4480edc3d5186826a8c1503f853ccf337a100fc9ab2ff" name="kernel-rt-64k-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.17.1.el9_8"/>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.11.1.el9_8]" date="1779192000">- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
- ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
- ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
- ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
- ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
- ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
- ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
- nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
- x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
- ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
- ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
- Revert "mm: pcp: increase pcp-&gt;free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.12.1.el9_8]" date="1779710400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.13.1.el9_8]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243}
- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472]
- nvme: nvme-fc: Ensure -&gt;ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786}
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167]
- crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613}
- mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778]
- mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778]
- mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778]
- mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778]
- mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778]
- mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778]
- mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778]</changelog>
  <changelog author="Tanishi Srivastava &lt;tsrivast@redhat.com&gt; [5.14.0-687.14.1.el9_8]" date="1781006400">- RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181}
- redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501}
- RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852}
- netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116}
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526]
- ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336]
- ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336]
- ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336]
- dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938]
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056}
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216}
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419}
- x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.15.1.el9_8]" date="1781092800">- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037}
- net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.16.1.el9_8]" date="1781611200">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308]
- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048]
- gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056}
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699]
- mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175820]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.17.1" date="1782216000">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="6089379ce27739ef7ff12760173bf5da3abb429b50f022e0a89410732e15383d" name="kernel-rt-64k-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.22.1.el9_8"/>
  <changelog author="Tanishi Srivastava &lt;tsrivast@redhat.com&gt; [5.14.0-687.14.1.el9_8]" date="1781006400">- RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181}
- redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501}
- RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852}
- netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116}
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526]
- ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336]
- ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336]
- ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336]
- dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938]
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056}
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216}
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419}
- x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.15.1.el9_8]" date="1781092800">- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037}
- net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.16.1.el9_8]" date="1781611200">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308]
- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048]
- gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056}
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699]
- mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175820]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.22.1" date="1783339201">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="13b724a7208b7b04f0821ba3987be5efb89c0642edcb1083c318f114f4d1099f" name="kernel-rt-64k-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.24.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.16.1.el9_8]" date="1781611200">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308]
- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048]
- gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056}
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699]
- mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175820]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.24.1" date="1783598400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="322d8512b8eef3cd1ad831aa4f9267036c17641639fbd49e539af20a088fcd95" name="kernel-rt-64k-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.25.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.25.1" date="1783944000">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="ab680358e17ee5ed502f319cd90a8302082c24cbbd62d73ad363f8174bf71ecf" name="kernel-rt-64k-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.26.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.26.1.el9_8]" date="1783944000">- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.26.1" date="1784030400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="f690f03a5d852817e21d2a76abfd09b8464a264ad518d33c634b515a392fc1ff" name="kernel-rt-64k-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.29.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [5.14.0-687.26.1.el9_8]" date="1784030400">- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.27.1.el9_8]" date="1784203200">- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886]
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113}
- crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943]
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110}
- net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121]
- net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121]
- net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121]
- net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121]
- net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121]
- net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121]
- net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121]
- net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121]
- net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121]
- net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121]
- net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix deadlock between devlink lock and esw-&gt;wq (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121]
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121]
- net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121]
- net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121]
- net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121]
- IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121]
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071}
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980]
- libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.28.1.el9_8]" date="1784548800">- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.29.1.el9_8]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685]
- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061]
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099}
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.29.1" date="1784721600">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="b269f4c17f93736335d81330ca3ba0b9fc46896dd9c49bd8eadb600266b622b5" name="kernel-rt-64k-debug" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.10.1.el9_8.0.1"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.3.1.el9_8]" date="1774008000">- HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818}
- NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415]
- perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340]
- perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340]
- perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340]
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193}
- nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552]
- redhat: genlog: add new JIRA cloud server hostname (Jan Stancek)
- gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055]
- io_uring: graduate to full support (Jeff Moyer) [RHEL-120699]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231}
- net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180}
- net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424]
- macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227]
- macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209}
- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814]
- migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.4.1.el9_8]" date="1774612800">- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144}
- ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365]
- libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611]
- libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611]
- libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611]
- libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611]
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611]
- libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611]
- redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611]
- redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611]
- crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611]
- ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210}
- smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396]
- wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.5.1.el9_8]" date="1775044800">- kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672]
- kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672]
- RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243}
- net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109}
- iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.6.1.el9_8]" date="1776340800">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402}
- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741}
- smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988]
- ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378]
- RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966]
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207]
- ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095]
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.10.1" date="1779278400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@resf.org&gt; - 5.14.0-687.10.1.0.1" date="1779537600">- Bump release for rebuild with updated rocky-sb-certs</changelog>
</package>
<package pkgid="f8bebbe9932135ebb477809887dda5c41c61e9ccd1f1adad50692f5e08ca8ac2" name="kernel-rt-64k-debug" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.12.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.4.1.el9_8]" date="1774612800">- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144}
- ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365]
- libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611]
- libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611]
- libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611]
- libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611]
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611]
- libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611]
- redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611]
- redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611]
- crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611]
- ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210}
- smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396]
- wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.5.1.el9_8]" date="1775044800">- kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672]
- kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672]
- RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243}
- net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109}
- iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.6.1.el9_8]" date="1776340800">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402}
- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741}
- smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988]
- ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378]
- RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966]
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207]
- ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095]
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.11.1.el9_8]" date="1779192000">- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
- ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
- ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
- ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
- ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
- ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
- ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
- nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
- x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
- ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
- ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
- Revert "mm: pcp: increase pcp-&gt;free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.12.1.el9_8]" date="1779710400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.12.1" date="1779969600">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="a358124bf58edcc3e59f425ac8e974a92809d9c67b06190c03de8d0cbad189a0" name="kernel-rt-64k-debug" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.15.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.11.1.el9_8]" date="1779192000">- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
- ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
- ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
- ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
- ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
- ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
- ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
- nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
- x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
- ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
- ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
- Revert "mm: pcp: increase pcp-&gt;free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.12.1.el9_8]" date="1779710400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.13.1.el9_8]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243}
- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472]
- nvme: nvme-fc: Ensure -&gt;ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786}
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167]
- crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613}
- mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778]
- mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778]
- mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778]
- mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778]
- mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778]
- mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778]
- mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778]</changelog>
  <changelog author="Tanishi Srivastava &lt;tsrivast@redhat.com&gt; [5.14.0-687.14.1.el9_8]" date="1781006400">- RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181}
- redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501}
- RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852}
- netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116}
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526]
- ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336]
- ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336]
- ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336]
- dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938]
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056}
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216}
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419}
- x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.15.1.el9_8]" date="1781092800">- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037}
- net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.15.1" date="1781179200">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="f91c7164e8aab6959bba12bd5004fc9ed3abfa0a072f2c48c214a68a3ca7d56e" name="kernel-rt-64k-debug" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.17.1.el9_8"/>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.11.1.el9_8]" date="1779192000">- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
- ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
- ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
- ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
- ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
- ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
- ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
- nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
- x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
- ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
- ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
- Revert "mm: pcp: increase pcp-&gt;free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.12.1.el9_8]" date="1779710400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.13.1.el9_8]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243}
- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472]
- nvme: nvme-fc: Ensure -&gt;ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786}
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167]
- crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613}
- mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778]
- mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778]
- mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778]
- mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778]
- mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778]
- mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778]
- mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778]</changelog>
  <changelog author="Tanishi Srivastava &lt;tsrivast@redhat.com&gt; [5.14.0-687.14.1.el9_8]" date="1781006400">- RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181}
- redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501}
- RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852}
- netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116}
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526]
- ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336]
- ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336]
- ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336]
- dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938]
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056}
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216}
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419}
- x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.15.1.el9_8]" date="1781092800">- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037}
- net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.16.1.el9_8]" date="1781611200">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308]
- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048]
- gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056}
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699]
- mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175820]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.17.1" date="1782216000">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="a940ede6c7b3b428676b74aacfbf44db7ef1456d501c3c4c82d85e717a897025" name="kernel-rt-64k-debug" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.22.1.el9_8"/>
  <changelog author="Tanishi Srivastava &lt;tsrivast@redhat.com&gt; [5.14.0-687.14.1.el9_8]" date="1781006400">- RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181}
- redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501}
- RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852}
- netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116}
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526]
- ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336]
- ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336]
- ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336]
- dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938]
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056}
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216}
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419}
- x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.15.1.el9_8]" date="1781092800">- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037}
- net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.16.1.el9_8]" date="1781611200">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308]
- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048]
- gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056}
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699]
- mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175820]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.22.1" date="1783339201">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="fbc2ab0c1bbfcab73ceaa02856df77a8deac700f5eac4bf583933fd3782180c2" name="kernel-rt-64k-debug" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.24.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.16.1.el9_8]" date="1781611200">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308]
- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048]
- gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056}
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699]
- mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175820]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.24.1" date="1783598400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="2c9ca5de2a28d47fd43c9845e18335f10cf2f3c90323e8f1901fc148026c4408" name="kernel-rt-64k-debug" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.25.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.25.1" date="1783944000">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="3259b2569cfdd721777e1301449f60b7ccb065b57fc89a403cde60386e181b2a" name="kernel-rt-64k-debug" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.26.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.26.1.el9_8]" date="1783944000">- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.26.1" date="1784030400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="44853ba71d361c9cc11c2ef81854777ff415f57df6e9722678b861c923ea6bc9" name="kernel-rt-64k-debug" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.29.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [5.14.0-687.26.1.el9_8]" date="1784030400">- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.27.1.el9_8]" date="1784203200">- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886]
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113}
- crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943]
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110}
- net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121]
- net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121]
- net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121]
- net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121]
- net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121]
- net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121]
- net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121]
- net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121]
- net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121]
- net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121]
- net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix deadlock between devlink lock and esw-&gt;wq (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121]
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121]
- net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121]
- net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121]
- net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121]
- IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121]
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071}
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980]
- libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.28.1.el9_8]" date="1784548800">- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.29.1.el9_8]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685]
- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061]
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099}
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.29.1" date="1784721600">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="904db199d9093bf9a3d3945892a97650b5672db6a004317fa8f25c8589085836" name="kernel-rt-64k-debug-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.10.1.el9_8.0.1"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.3.1.el9_8]" date="1774008000">- HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818}
- NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415]
- perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340]
- perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340]
- perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340]
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193}
- nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552]
- redhat: genlog: add new JIRA cloud server hostname (Jan Stancek)
- gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055]
- io_uring: graduate to full support (Jeff Moyer) [RHEL-120699]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231}
- net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180}
- net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424]
- macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227]
- macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209}
- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814]
- migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.4.1.el9_8]" date="1774612800">- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144}
- ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365]
- libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611]
- libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611]
- libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611]
- libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611]
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611]
- libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611]
- redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611]
- redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611]
- crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611]
- ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210}
- smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396]
- wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.5.1.el9_8]" date="1775044800">- kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672]
- kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672]
- RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243}
- net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109}
- iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.6.1.el9_8]" date="1776340800">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402}
- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741}
- smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988]
- ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378]
- RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966]
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207]
- ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095]
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.10.1" date="1779278400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@resf.org&gt; - 5.14.0-687.10.1.0.1" date="1779537600">- Bump release for rebuild with updated rocky-sb-certs</changelog>
</package>
<package pkgid="5023e1484fc60be82bdcccc9c6fdcc8ef4da2cb4d9f5790a7737b92efec31368" name="kernel-rt-64k-debug-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.12.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.4.1.el9_8]" date="1774612800">- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144}
- ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365]
- libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611]
- libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611]
- libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611]
- libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611]
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611]
- libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611]
- redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611]
- redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611]
- crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611]
- ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210}
- smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396]
- wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.5.1.el9_8]" date="1775044800">- kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672]
- kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672]
- RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243}
- net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109}
- iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.6.1.el9_8]" date="1776340800">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402}
- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741}
- smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988]
- ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378]
- RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966]
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207]
- ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095]
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.11.1.el9_8]" date="1779192000">- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
- ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
- ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
- ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
- ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
- ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
- ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
- nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
- x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
- ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
- ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
- Revert "mm: pcp: increase pcp-&gt;free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.12.1.el9_8]" date="1779710400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.12.1" date="1779969600">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="e69923d7cfccf4305aaa6f38c769c71bdca2732bb2b823a8a25497163cb2fe4e" name="kernel-rt-64k-debug-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.15.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.11.1.el9_8]" date="1779192000">- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
- ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
- ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
- ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
- ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
- ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
- ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
- nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
- x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
- ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
- ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
- Revert "mm: pcp: increase pcp-&gt;free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.12.1.el9_8]" date="1779710400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.13.1.el9_8]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243}
- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472]
- nvme: nvme-fc: Ensure -&gt;ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786}
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167]
- crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613}
- mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778]
- mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778]
- mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778]
- mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778]
- mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778]
- mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778]
- mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778]</changelog>
  <changelog author="Tanishi Srivastava &lt;tsrivast@redhat.com&gt; [5.14.0-687.14.1.el9_8]" date="1781006400">- RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181}
- redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501}
- RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852}
- netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116}
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526]
- ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336]
- ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336]
- ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336]
- dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938]
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056}
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216}
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419}
- x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.15.1.el9_8]" date="1781092800">- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037}
- net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.15.1" date="1781179200">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="320340d125e16369ecfeadb13f64adf5e0db909e2c6939f86a0e5c85daed4862" name="kernel-rt-64k-debug-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.17.1.el9_8"/>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.11.1.el9_8]" date="1779192000">- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
- ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
- ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
- ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
- ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
- ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
- ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
- nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
- x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
- ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
- ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
- Revert "mm: pcp: increase pcp-&gt;free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.12.1.el9_8]" date="1779710400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.13.1.el9_8]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243}
- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472]
- nvme: nvme-fc: Ensure -&gt;ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786}
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167]
- crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613}
- mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778]
- mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778]
- mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778]
- mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778]
- mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778]
- mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778]
- mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778]</changelog>
  <changelog author="Tanishi Srivastava &lt;tsrivast@redhat.com&gt; [5.14.0-687.14.1.el9_8]" date="1781006400">- RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181}
- redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501}
- RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852}
- netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116}
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526]
- ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336]
- ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336]
- ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336]
- dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938]
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056}
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216}
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419}
- x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.15.1.el9_8]" date="1781092800">- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037}
- net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.16.1.el9_8]" date="1781611200">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308]
- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048]
- gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056}
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699]
- mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175820]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.17.1" date="1782216000">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="27eacb264e863eb089edd4242588066de340e3a528472c91ffa77632ca221b20" name="kernel-rt-64k-debug-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.22.1.el9_8"/>
  <changelog author="Tanishi Srivastava &lt;tsrivast@redhat.com&gt; [5.14.0-687.14.1.el9_8]" date="1781006400">- RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181}
- redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501}
- RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852}
- netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116}
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526]
- ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336]
- ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336]
- ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336]
- dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938]
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056}
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216}
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419}
- x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.15.1.el9_8]" date="1781092800">- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037}
- net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.16.1.el9_8]" date="1781611200">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308]
- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048]
- gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056}
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699]
- mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175820]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.22.1" date="1783339201">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="bf6b8ed329f1d3520719d60578938faee3dc420353feb415651329843e754a52" name="kernel-rt-64k-debug-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.24.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.16.1.el9_8]" date="1781611200">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308]
- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048]
- gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056}
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699]
- mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175820]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.24.1" date="1783598400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="9be65e409a046b99d41b1ac42315a3e578f850c86bce71bc0021b3cadf89c1b2" name="kernel-rt-64k-debug-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.25.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.25.1" date="1783944000">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="d5106b9a3beed7b971ddbc6812a20f2d38aead1141034b4564dc7b7eaf13b2ff" name="kernel-rt-64k-debug-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.26.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.26.1.el9_8]" date="1783944000">- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.26.1" date="1784030400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="9cc149c01d40de315413c93eaa065b79b7b93698a5a4499b2fae62bc04ebc4f2" name="kernel-rt-64k-debug-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.29.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [5.14.0-687.26.1.el9_8]" date="1784030400">- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.27.1.el9_8]" date="1784203200">- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886]
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113}
- crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943]
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110}
- net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121]
- net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121]
- net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121]
- net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121]
- net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121]
- net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121]
- net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121]
- net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121]
- net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121]
- net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121]
- net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix deadlock between devlink lock and esw-&gt;wq (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121]
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121]
- net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121]
- net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121]
- net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121]
- IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121]
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071}
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980]
- libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.28.1.el9_8]" date="1784548800">- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.29.1.el9_8]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685]
- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061]
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099}
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.29.1" date="1784721600">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="0c4b8ff474845a7900d95cc158ae6024a91a49840a2a1f86da248d65f5baa243" name="kernel-rt-64k-debug-devel" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.10.1.el9_8.0.1"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.3.1.el9_8]" date="1774008000">- HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818}
- NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415]
- perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340]
- perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340]
- perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340]
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193}
- nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552]
- redhat: genlog: add new JIRA cloud server hostname (Jan Stancek)
- gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055]
- io_uring: graduate to full support (Jeff Moyer) [RHEL-120699]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231}
- net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180}
- net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424]
- macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227]
- macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209}
- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814]
- migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.4.1.el9_8]" date="1774612800">- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144}
- ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365]
- libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611]
- libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611]
- libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611]
- libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611]
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611]
- libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611]
- redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611]
- redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611]
- crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611]
- ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210}
- smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396]
- wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.5.1.el9_8]" date="1775044800">- kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672]
- kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672]
- RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243}
- net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109}
- iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.6.1.el9_8]" date="1776340800">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402}
- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741}
- smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988]
- ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378]
- RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966]
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207]
- ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095]
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.10.1" date="1779278400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@resf.org&gt; - 5.14.0-687.10.1.0.1" date="1779537600">- Bump release for rebuild with updated rocky-sb-certs</changelog>
</package>
<package pkgid="ec2c2c1c2234416ed4a585f81d699730aed287f3c4bb7f037186f946939b3e25" name="kernel-rt-64k-debug-devel" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.12.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.4.1.el9_8]" date="1774612800">- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144}
- ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365]
- libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611]
- libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611]
- libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611]
- libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611]
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611]
- libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611]
- redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611]
- redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611]
- crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611]
- ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210}
- smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396]
- wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.5.1.el9_8]" date="1775044800">- kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672]
- kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672]
- RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243}
- net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109}
- iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.6.1.el9_8]" date="1776340800">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402}
- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741}
- smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988]
- ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378]
- RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966]
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207]
- ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095]
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.11.1.el9_8]" date="1779192000">- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
- ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
- ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
- ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
- ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
- ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
- ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
- nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
- x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
- ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
- ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
- Revert "mm: pcp: increase pcp-&gt;free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.12.1.el9_8]" date="1779710400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.12.1" date="1779969600">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="66a4d994ba39c23c39536b8bc34814bc30a2bb17b3a66cb5bc35a7d218f381b7" name="kernel-rt-64k-debug-devel" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.15.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.11.1.el9_8]" date="1779192000">- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
- ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
- ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
- ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
- ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
- ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
- ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
- nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
- x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
- ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
- ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
- Revert "mm: pcp: increase pcp-&gt;free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.12.1.el9_8]" date="1779710400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.13.1.el9_8]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243}
- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472]
- nvme: nvme-fc: Ensure -&gt;ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786}
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167]
- crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613}
- mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778]
- mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778]
- mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778]
- mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778]
- mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778]
- mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778]
- mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778]</changelog>
  <changelog author="Tanishi Srivastava &lt;tsrivast@redhat.com&gt; [5.14.0-687.14.1.el9_8]" date="1781006400">- RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181}
- redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501}
- RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852}
- netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116}
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526]
- ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336]
- ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336]
- ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336]
- dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938]
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056}
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216}
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419}
- x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.15.1.el9_8]" date="1781092800">- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037}
- net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.15.1" date="1781179200">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="fac700ad34bad9a94dcfa3001c5037908992aab0c049c6758790de97dd630f17" name="kernel-rt-64k-debug-devel" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.17.1.el9_8"/>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.11.1.el9_8]" date="1779192000">- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
- ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
- ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
- ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
- ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
- ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
- ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
- nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
- x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
- ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
- ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
- Revert "mm: pcp: increase pcp-&gt;free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.12.1.el9_8]" date="1779710400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.13.1.el9_8]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243}
- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472]
- nvme: nvme-fc: Ensure -&gt;ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786}
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167]
- crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613}
- mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778]
- mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778]
- mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778]
- mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778]
- mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778]
- mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778]
- mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778]</changelog>
  <changelog author="Tanishi Srivastava &lt;tsrivast@redhat.com&gt; [5.14.0-687.14.1.el9_8]" date="1781006400">- RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181}
- redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501}
- RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852}
- netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116}
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526]
- ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336]
- ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336]
- ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336]
- dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938]
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056}
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216}
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419}
- x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.15.1.el9_8]" date="1781092800">- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037}
- net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.16.1.el9_8]" date="1781611200">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308]
- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048]
- gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056}
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699]
- mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175820]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.17.1" date="1782216000">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="363d7730c477eac2f602a1287853a4dfcf6a4b0c1d5a9ac092e6b73df0efd2df" name="kernel-rt-64k-debug-devel" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.22.1.el9_8"/>
  <changelog author="Tanishi Srivastava &lt;tsrivast@redhat.com&gt; [5.14.0-687.14.1.el9_8]" date="1781006400">- RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181}
- redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501}
- RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852}
- netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116}
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526]
- ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336]
- ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336]
- ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336]
- dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938]
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056}
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216}
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419}
- x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.15.1.el9_8]" date="1781092800">- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037}
- net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.16.1.el9_8]" date="1781611200">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308]
- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048]
- gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056}
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699]
- mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175820]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.22.1" date="1783339201">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="819a222736aeaf54cdafb843f4f10914d52e4aa13dad8861627dc6b0dee436b0" name="kernel-rt-64k-debug-devel" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.24.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.16.1.el9_8]" date="1781611200">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308]
- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048]
- gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056}
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699]
- mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175820]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.24.1" date="1783598400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="3252c4cabcf5637488b76e58bea04d5351461b3e90d0aef1a00d267aabf292cb" name="kernel-rt-64k-debug-devel" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.25.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.25.1" date="1783944000">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="acd81b4291405e4f68d593d3f3e071bd8a24480933789303e6750c1d01dcc535" name="kernel-rt-64k-debug-devel" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.26.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.26.1.el9_8]" date="1783944000">- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.26.1" date="1784030400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="5333fac73f48844a2a21a3f15b5aafcdc4fb29729bceae7e7e0e5073f504d933" name="kernel-rt-64k-debug-devel" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.29.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [5.14.0-687.26.1.el9_8]" date="1784030400">- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.27.1.el9_8]" date="1784203200">- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886]
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113}
- crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943]
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110}
- net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121]
- net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121]
- net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121]
- net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121]
- net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121]
- net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121]
- net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121]
- net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121]
- net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121]
- net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121]
- net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix deadlock between devlink lock and esw-&gt;wq (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121]
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121]
- net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121]
- net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121]
- net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121]
- IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121]
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071}
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980]
- libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.28.1.el9_8]" date="1784548800">- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.29.1.el9_8]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685]
- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061]
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099}
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.29.1" date="1784721600">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="1a2ac6796c30fc4fb0b5aa28aabc780740d12657f9fcd59d745f42ef608094f3" name="kernel-rt-64k-debug-modules" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.10.1.el9_8.0.1"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.3.1.el9_8]" date="1774008000">- HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818}
- NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415]
- perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340]
- perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340]
- perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340]
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193}
- nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552]
- redhat: genlog: add new JIRA cloud server hostname (Jan Stancek)
- gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055]
- io_uring: graduate to full support (Jeff Moyer) [RHEL-120699]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231}
- net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180}
- net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424]
- macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227]
- macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209}
- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814]
- migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.4.1.el9_8]" date="1774612800">- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144}
- ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365]
- libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611]
- libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611]
- libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611]
- libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611]
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611]
- libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611]
- redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611]
- redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611]
- crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611]
- ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210}
- smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396]
- wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.5.1.el9_8]" date="1775044800">- kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672]
- kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672]
- RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243}
- net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109}
- iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.6.1.el9_8]" date="1776340800">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402}
- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741}
- smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988]
- ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378]
- RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966]
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207]
- ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095]
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.10.1" date="1779278400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@resf.org&gt; - 5.14.0-687.10.1.0.1" date="1779537600">- Bump release for rebuild with updated rocky-sb-certs</changelog>
</package>
<package pkgid="e2ee47630491017625f3369680b1a427c2d54168464bb6ce99ee40741d3d582e" name="kernel-rt-64k-debug-modules" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.12.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.4.1.el9_8]" date="1774612800">- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144}
- ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365]
- libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611]
- libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611]
- libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611]
- libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611]
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611]
- libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611]
- redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611]
- redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611]
- crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611]
- ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210}
- smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396]
- wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.5.1.el9_8]" date="1775044800">- kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672]
- kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672]
- RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243}
- net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109}
- iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.6.1.el9_8]" date="1776340800">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402}
- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741}
- smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988]
- ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378]
- RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966]
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207]
- ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095]
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.11.1.el9_8]" date="1779192000">- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
- ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
- ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
- ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
- ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
- ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
- ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
- nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
- x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
- ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
- ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
- Revert "mm: pcp: increase pcp-&gt;free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.12.1.el9_8]" date="1779710400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.12.1" date="1779969600">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="abb423e8240c226436b8682e5777a524d8839fbaf340446d2110ff3d947c2e78" name="kernel-rt-64k-debug-modules" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.15.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.11.1.el9_8]" date="1779192000">- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
- ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
- ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
- ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
- ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
- ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
- ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
- nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
- x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
- ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
- ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
- Revert "mm: pcp: increase pcp-&gt;free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.12.1.el9_8]" date="1779710400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.13.1.el9_8]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243}
- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472]
- nvme: nvme-fc: Ensure -&gt;ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786}
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167]
- crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613}
- mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778]
- mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778]
- mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778]
- mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778]
- mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778]
- mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778]
- mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778]</changelog>
  <changelog author="Tanishi Srivastava &lt;tsrivast@redhat.com&gt; [5.14.0-687.14.1.el9_8]" date="1781006400">- RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181}
- redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501}
- RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852}
- netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116}
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526]
- ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336]
- ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336]
- ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336]
- dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938]
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056}
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216}
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419}
- x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.15.1.el9_8]" date="1781092800">- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037}
- net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.15.1" date="1781179200">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="41353949f0b984f0eb65625eef0df6e46b196024c2e16e5c3b3f4f6fb8a9b890" name="kernel-rt-64k-debug-modules" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.17.1.el9_8"/>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.11.1.el9_8]" date="1779192000">- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
- ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
- ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
- ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
- ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
- ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
- ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
- nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
- x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
- ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
- ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
- Revert "mm: pcp: increase pcp-&gt;free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.12.1.el9_8]" date="1779710400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.13.1.el9_8]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243}
- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472]
- nvme: nvme-fc: Ensure -&gt;ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786}
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167]
- crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613}
- mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778]
- mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778]
- mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778]
- mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778]
- mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778]
- mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778]
- mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778]</changelog>
  <changelog author="Tanishi Srivastava &lt;tsrivast@redhat.com&gt; [5.14.0-687.14.1.el9_8]" date="1781006400">- RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181}
- redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501}
- RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852}
- netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116}
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526]
- ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336]
- ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336]
- ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336]
- dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938]
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056}
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216}
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419}
- x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.15.1.el9_8]" date="1781092800">- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037}
- net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.16.1.el9_8]" date="1781611200">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308]
- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048]
- gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056}
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699]
- mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175820]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.17.1" date="1782216000">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="f04549348b28af2b66d85dce39c55e4ce59ee96f3aa3691e23e850cd8bc0f27a" name="kernel-rt-64k-debug-modules" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.22.1.el9_8"/>
  <changelog author="Tanishi Srivastava &lt;tsrivast@redhat.com&gt; [5.14.0-687.14.1.el9_8]" date="1781006400">- RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181}
- redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501}
- RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852}
- netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116}
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526]
- ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336]
- ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336]
- ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336]
- dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938]
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056}
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216}
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419}
- x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.15.1.el9_8]" date="1781092800">- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037}
- net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.16.1.el9_8]" date="1781611200">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308]
- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048]
- gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056}
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699]
- mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175820]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.22.1" date="1783339201">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="43f26adf9be8ae6205c29a3d8ab1b905dd3a7bc7ad62629fb3cb1f4eeee79de3" name="kernel-rt-64k-debug-modules" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.24.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.16.1.el9_8]" date="1781611200">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308]
- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048]
- gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056}
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699]
- mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175820]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.24.1" date="1783598400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="8531a1c5a9856d766f5894b01002989c2e4fa08d795a6570c49911b999d094b1" name="kernel-rt-64k-debug-modules" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.25.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.25.1" date="1783944000">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="ab6bbcc2ad48385fced0c1d8aee017886c8c98bb365b28bebf8cbf38111e3506" name="kernel-rt-64k-debug-modules" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.26.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.26.1.el9_8]" date="1783944000">- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.26.1" date="1784030400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="c5d98d94dad097448b7c10f908a4e450b99a5b3456094bebb2150afa17b6fb5d" name="kernel-rt-64k-debug-modules" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.29.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [5.14.0-687.26.1.el9_8]" date="1784030400">- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.27.1.el9_8]" date="1784203200">- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886]
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113}
- crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943]
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110}
- net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121]
- net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121]
- net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121]
- net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121]
- net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121]
- net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121]
- net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121]
- net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121]
- net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121]
- net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121]
- net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix deadlock between devlink lock and esw-&gt;wq (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121]
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121]
- net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121]
- net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121]
- net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121]
- IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121]
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071}
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980]
- libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.28.1.el9_8]" date="1784548800">- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.29.1.el9_8]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685]
- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061]
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099}
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.29.1" date="1784721600">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="dda6deb2d3fb348e7e57e115a6723f13d2d8b2ba9fafe0a7b51436d42010a202" name="kernel-rt-64k-debug-modules-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.10.1.el9_8.0.1"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.3.1.el9_8]" date="1774008000">- HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818}
- NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415]
- perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340]
- perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340]
- perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340]
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193}
- nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552]
- redhat: genlog: add new JIRA cloud server hostname (Jan Stancek)
- gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055]
- io_uring: graduate to full support (Jeff Moyer) [RHEL-120699]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231}
- net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180}
- net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424]
- macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227]
- macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209}
- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814]
- migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.4.1.el9_8]" date="1774612800">- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144}
- ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365]
- libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611]
- libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611]
- libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611]
- libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611]
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611]
- libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611]
- redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611]
- redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611]
- crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611]
- ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210}
- smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396]
- wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.5.1.el9_8]" date="1775044800">- kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672]
- kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672]
- RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243}
- net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109}
- iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.6.1.el9_8]" date="1776340800">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402}
- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741}
- smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988]
- ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378]
- RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966]
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207]
- ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095]
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.10.1" date="1779278400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@resf.org&gt; - 5.14.0-687.10.1.0.1" date="1779537600">- Bump release for rebuild with updated rocky-sb-certs</changelog>
</package>
<package pkgid="8f29cb1cbdb71d33006e8511794477027f0a24ee5361a6a06c95d14b7218aac4" name="kernel-rt-64k-debug-modules-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.12.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.4.1.el9_8]" date="1774612800">- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144}
- ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365]
- libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611]
- libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611]
- libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611]
- libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611]
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611]
- libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611]
- redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611]
- redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611]
- crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611]
- ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210}
- smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396]
- wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.5.1.el9_8]" date="1775044800">- kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672]
- kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672]
- RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243}
- net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109}
- iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.6.1.el9_8]" date="1776340800">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402}
- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741}
- smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988]
- ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378]
- RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966]
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207]
- ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095]
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.11.1.el9_8]" date="1779192000">- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
- ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
- ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
- ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
- ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
- ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
- ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
- nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
- x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
- ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
- ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
- Revert "mm: pcp: increase pcp-&gt;free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.12.1.el9_8]" date="1779710400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.12.1" date="1779969600">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="9e25a21bb460bcfa69934af8c8c219fb82fd999c7c5343c0df28ead41714442c" name="kernel-rt-64k-debug-modules-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.15.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.11.1.el9_8]" date="1779192000">- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
- ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
- ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
- ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
- ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
- ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
- ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
- nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
- x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
- ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
- ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
- Revert "mm: pcp: increase pcp-&gt;free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.12.1.el9_8]" date="1779710400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.13.1.el9_8]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243}
- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472]
- nvme: nvme-fc: Ensure -&gt;ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786}
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167]
- crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613}
- mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778]
- mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778]
- mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778]
- mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778]
- mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778]
- mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778]
- mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778]</changelog>
  <changelog author="Tanishi Srivastava &lt;tsrivast@redhat.com&gt; [5.14.0-687.14.1.el9_8]" date="1781006400">- RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181}
- redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501}
- RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852}
- netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116}
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526]
- ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336]
- ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336]
- ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336]
- dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938]
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056}
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216}
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419}
- x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.15.1.el9_8]" date="1781092800">- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037}
- net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.15.1" date="1781179200">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="8b3e3361b091d47e80bbb5a55e01b59131102b97bc6e1dffd2d66f8d2decf5a9" name="kernel-rt-64k-debug-modules-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.17.1.el9_8"/>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.11.1.el9_8]" date="1779192000">- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
- ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
- ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
- ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
- ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
- ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
- ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
- nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
- x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
- ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
- ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
- Revert "mm: pcp: increase pcp-&gt;free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.12.1.el9_8]" date="1779710400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.13.1.el9_8]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243}
- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472]
- nvme: nvme-fc: Ensure -&gt;ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786}
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167]
- crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613}
- mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778]
- mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778]
- mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778]
- mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778]
- mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778]
- mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778]
- mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778]</changelog>
  <changelog author="Tanishi Srivastava &lt;tsrivast@redhat.com&gt; [5.14.0-687.14.1.el9_8]" date="1781006400">- RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181}
- redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501}
- RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852}
- netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116}
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526]
- ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336]
- ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336]
- ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336]
- dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938]
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056}
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216}
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419}
- x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.15.1.el9_8]" date="1781092800">- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037}
- net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.16.1.el9_8]" date="1781611200">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308]
- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048]
- gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056}
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699]
- mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175820]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.17.1" date="1782216000">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="3ae379ec66f02a9df8dc77a20829f93de072f3d5ab2cd6741009edd25c0bb1e9" name="kernel-rt-64k-debug-modules-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.22.1.el9_8"/>
  <changelog author="Tanishi Srivastava &lt;tsrivast@redhat.com&gt; [5.14.0-687.14.1.el9_8]" date="1781006400">- RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181}
- redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501}
- RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852}
- netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116}
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526]
- ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336]
- ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336]
- ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336]
- dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938]
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056}
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216}
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419}
- x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.15.1.el9_8]" date="1781092800">- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037}
- net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.16.1.el9_8]" date="1781611200">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308]
- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048]
- gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056}
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699]
- mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175820]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.22.1" date="1783339201">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="720de0a86faeb7c506b3fc05ef8f772e08e39f2ff2b020d3e3e48feadd4881d5" name="kernel-rt-64k-debug-modules-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.24.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.16.1.el9_8]" date="1781611200">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308]
- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048]
- gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056}
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699]
- mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175820]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.24.1" date="1783598400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="3c208ce71bcb8a9f136976ca795ee097b435fbd174468a3552508e3b2690e99f" name="kernel-rt-64k-debug-modules-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.25.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.25.1" date="1783944000">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="2b341063441ba0d9c826e0c6929674f949b09aeb7e4758ef2fd4f3281513cadf" name="kernel-rt-64k-debug-modules-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.26.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.26.1.el9_8]" date="1783944000">- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.26.1" date="1784030400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="d21033af7bf571c2698c8d76a88321f084674594bb1957b23d04147d1b5b66a7" name="kernel-rt-64k-debug-modules-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.29.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [5.14.0-687.26.1.el9_8]" date="1784030400">- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.27.1.el9_8]" date="1784203200">- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886]
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113}
- crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943]
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110}
- net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121]
- net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121]
- net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121]
- net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121]
- net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121]
- net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121]
- net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121]
- net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121]
- net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121]
- net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121]
- net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix deadlock between devlink lock and esw-&gt;wq (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121]
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121]
- net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121]
- net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121]
- net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121]
- IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121]
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071}
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980]
- libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.28.1.el9_8]" date="1784548800">- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.29.1.el9_8]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685]
- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061]
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099}
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.29.1" date="1784721600">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="6829cb0e3b35560a1ed769c18ec828ae911d26694b3ca2b01c1b9fc75702dade" name="kernel-rt-64k-debug-modules-extra" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.10.1.el9_8.0.1"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.3.1.el9_8]" date="1774008000">- HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818}
- NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415]
- perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340]
- perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340]
- perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340]
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193}
- nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552]
- redhat: genlog: add new JIRA cloud server hostname (Jan Stancek)
- gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055]
- io_uring: graduate to full support (Jeff Moyer) [RHEL-120699]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231}
- net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180}
- net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424]
- macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227]
- macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209}
- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814]
- migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.4.1.el9_8]" date="1774612800">- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144}
- ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365]
- libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611]
- libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611]
- libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611]
- libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611]
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611]
- libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611]
- redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611]
- redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611]
- crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611]
- ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210}
- smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396]
- wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.5.1.el9_8]" date="1775044800">- kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672]
- kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672]
- RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243}
- net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109}
- iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.6.1.el9_8]" date="1776340800">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402}
- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741}
- smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988]
- ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378]
- RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966]
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207]
- ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095]
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.10.1" date="1779278400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@resf.org&gt; - 5.14.0-687.10.1.0.1" date="1779537600">- Bump release for rebuild with updated rocky-sb-certs</changelog>
</package>
<package pkgid="cc5b58b9a7eddd13299e20e6cc93c7b42e6148f36f12bd65ce825df416a6df8f" name="kernel-rt-64k-debug-modules-extra" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.12.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.4.1.el9_8]" date="1774612800">- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144}
- ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365]
- libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611]
- libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611]
- libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611]
- libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611]
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611]
- libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611]
- redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611]
- redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611]
- crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611]
- ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210}
- smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396]
- wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.5.1.el9_8]" date="1775044800">- kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672]
- kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672]
- RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243}
- net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109}
- iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.6.1.el9_8]" date="1776340800">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402}
- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741}
- smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988]
- ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378]
- RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966]
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207]
- ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095]
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.11.1.el9_8]" date="1779192000">- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
- ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
- ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
- ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
- ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
- ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
- ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
- nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
- x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
- ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
- ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
- Revert "mm: pcp: increase pcp-&gt;free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.12.1.el9_8]" date="1779710400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.12.1" date="1779969600">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="444a35904b5633eb46c2b86aac6c7ab9d2f6ce524650c0356fc529ea3ddf2e7f" name="kernel-rt-64k-debug-modules-extra" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.15.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.11.1.el9_8]" date="1779192000">- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
- ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
- ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
- ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
- ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
- ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
- ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
- nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
- x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
- ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
- ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
- Revert "mm: pcp: increase pcp-&gt;free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.12.1.el9_8]" date="1779710400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.13.1.el9_8]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243}
- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472]
- nvme: nvme-fc: Ensure -&gt;ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786}
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167]
- crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613}
- mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778]
- mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778]
- mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778]
- mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778]
- mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778]
- mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778]
- mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778]</changelog>
  <changelog author="Tanishi Srivastava &lt;tsrivast@redhat.com&gt; [5.14.0-687.14.1.el9_8]" date="1781006400">- RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181}
- redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501}
- RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852}
- netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116}
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526]
- ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336]
- ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336]
- ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336]
- dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938]
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056}
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216}
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419}
- x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.15.1.el9_8]" date="1781092800">- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037}
- net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.15.1" date="1781179200">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="abd9815e2f9a288a71d66b590b6c33ef958387747e1b56ed6b11e45575f447f3" name="kernel-rt-64k-debug-modules-extra" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.17.1.el9_8"/>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.11.1.el9_8]" date="1779192000">- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
- ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
- ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
- ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
- ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
- ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
- ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
- nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
- x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
- ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
- ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
- Revert "mm: pcp: increase pcp-&gt;free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.12.1.el9_8]" date="1779710400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.13.1.el9_8]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243}
- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472]
- nvme: nvme-fc: Ensure -&gt;ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786}
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167]
- crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613}
- mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778]
- mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778]
- mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778]
- mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778]
- mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778]
- mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778]
- mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778]</changelog>
  <changelog author="Tanishi Srivastava &lt;tsrivast@redhat.com&gt; [5.14.0-687.14.1.el9_8]" date="1781006400">- RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181}
- redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501}
- RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852}
- netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116}
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526]
- ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336]
- ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336]
- ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336]
- dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938]
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056}
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216}
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419}
- x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.15.1.el9_8]" date="1781092800">- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037}
- net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.16.1.el9_8]" date="1781611200">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308]
- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048]
- gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056}
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699]
- mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175820]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.17.1" date="1782216000">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="023d9d5337e17b3a675e7c1af91821a20bfeb71c6c88753371c3d917c96423b2" name="kernel-rt-64k-debug-modules-extra" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.22.1.el9_8"/>
  <changelog author="Tanishi Srivastava &lt;tsrivast@redhat.com&gt; [5.14.0-687.14.1.el9_8]" date="1781006400">- RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181}
- redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501}
- RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852}
- netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116}
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526]
- ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336]
- ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336]
- ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336]
- dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938]
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056}
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216}
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419}
- x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.15.1.el9_8]" date="1781092800">- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037}
- net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.16.1.el9_8]" date="1781611200">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308]
- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048]
- gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056}
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699]
- mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175820]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.22.1" date="1783339201">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="580ee68a36ad2dd20f563893d6b9744a16552c93f9c4ef56cfa36fa5130e8cb3" name="kernel-rt-64k-debug-modules-extra" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.24.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.16.1.el9_8]" date="1781611200">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308]
- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048]
- gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056}
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699]
- mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175820]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.24.1" date="1783598400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="1423e092351bb63eae8e09b18a19e180bab3bed6efb1a8da7fd9102c16446c98" name="kernel-rt-64k-debug-modules-extra" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.25.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.25.1" date="1783944000">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="f941116c2b2ac6867d74446975f46813bd4d90914d7494f477e9f872ee176736" name="kernel-rt-64k-debug-modules-extra" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.26.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.26.1.el9_8]" date="1783944000">- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.26.1" date="1784030400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="d5f6c40d989cba2f5bf4c9e17ffc144e0f7745309e68f8653f34c7ad2d44680a" name="kernel-rt-64k-debug-modules-extra" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.29.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [5.14.0-687.26.1.el9_8]" date="1784030400">- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.27.1.el9_8]" date="1784203200">- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886]
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113}
- crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943]
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110}
- net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121]
- net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121]
- net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121]
- net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121]
- net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121]
- net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121]
- net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121]
- net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121]
- net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121]
- net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121]
- net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix deadlock between devlink lock and esw-&gt;wq (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121]
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121]
- net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121]
- net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121]
- net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121]
- IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121]
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071}
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980]
- libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.28.1.el9_8]" date="1784548800">- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.29.1.el9_8]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685]
- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061]
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099}
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.29.1" date="1784721600">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="16a3839daca2f486ff94cd68238e21364da9ce5f7cf20ee4cca5c02f1cd0f6b0" name="kernel-rt-64k-devel" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.10.1.el9_8.0.1"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.3.1.el9_8]" date="1774008000">- HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818}
- NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415]
- perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340]
- perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340]
- perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340]
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193}
- nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552]
- redhat: genlog: add new JIRA cloud server hostname (Jan Stancek)
- gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055]
- io_uring: graduate to full support (Jeff Moyer) [RHEL-120699]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231}
- net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180}
- net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424]
- macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227]
- macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209}
- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814]
- migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.4.1.el9_8]" date="1774612800">- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144}
- ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365]
- libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611]
- libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611]
- libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611]
- libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611]
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611]
- libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611]
- redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611]
- redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611]
- crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611]
- ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210}
- smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396]
- wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.5.1.el9_8]" date="1775044800">- kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672]
- kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672]
- RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243}
- net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109}
- iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.6.1.el9_8]" date="1776340800">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402}
- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741}
- smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988]
- ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378]
- RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966]
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207]
- ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095]
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.10.1" date="1779278400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@resf.org&gt; - 5.14.0-687.10.1.0.1" date="1779537600">- Bump release for rebuild with updated rocky-sb-certs</changelog>
</package>
<package pkgid="056ed3d9f380d01ce37842cac85a61a10dbf4b3eb0a887cb8ad91361a7d917d2" name="kernel-rt-64k-devel" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.12.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.4.1.el9_8]" date="1774612800">- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144}
- ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365]
- libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611]
- libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611]
- libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611]
- libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611]
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611]
- libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611]
- redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611]
- redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611]
- crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611]
- ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210}
- smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396]
- wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.5.1.el9_8]" date="1775044800">- kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672]
- kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672]
- RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243}
- net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109}
- iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.6.1.el9_8]" date="1776340800">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402}
- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741}
- smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988]
- ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378]
- RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966]
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207]
- ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095]
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.11.1.el9_8]" date="1779192000">- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
- ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
- ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
- ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
- ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
- ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
- ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
- nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
- x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
- ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
- ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
- Revert "mm: pcp: increase pcp-&gt;free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.12.1.el9_8]" date="1779710400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.12.1" date="1779969600">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="09e4212f82c88bd9bb63f24e15673b49a55cd8e6bdd3197ac66c84383aee73a1" name="kernel-rt-64k-devel" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.15.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.11.1.el9_8]" date="1779192000">- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
- ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
- ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
- ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
- ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
- ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
- ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
- nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
- x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
- ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
- ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
- Revert "mm: pcp: increase pcp-&gt;free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.12.1.el9_8]" date="1779710400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.13.1.el9_8]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243}
- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472]
- nvme: nvme-fc: Ensure -&gt;ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786}
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167]
- crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613}
- mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778]
- mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778]
- mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778]
- mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778]
- mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778]
- mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778]
- mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778]</changelog>
  <changelog author="Tanishi Srivastava &lt;tsrivast@redhat.com&gt; [5.14.0-687.14.1.el9_8]" date="1781006400">- RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181}
- redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501}
- RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852}
- netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116}
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526]
- ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336]
- ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336]
- ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336]
- dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938]
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056}
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216}
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419}
- x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.15.1.el9_8]" date="1781092800">- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037}
- net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.15.1" date="1781179200">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="91b9d680c660ce86a89d59ce5de40664a4d7da3d54b79b32ce7657d24cdcb7c7" name="kernel-rt-64k-devel" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.17.1.el9_8"/>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.11.1.el9_8]" date="1779192000">- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
- ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
- ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
- ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
- ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
- ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
- ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
- nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
- x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
- ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
- ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
- Revert "mm: pcp: increase pcp-&gt;free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.12.1.el9_8]" date="1779710400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.13.1.el9_8]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243}
- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472]
- nvme: nvme-fc: Ensure -&gt;ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786}
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167]
- crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613}
- mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778]
- mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778]
- mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778]
- mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778]
- mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778]
- mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778]
- mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778]</changelog>
  <changelog author="Tanishi Srivastava &lt;tsrivast@redhat.com&gt; [5.14.0-687.14.1.el9_8]" date="1781006400">- RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181}
- redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501}
- RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852}
- netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116}
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526]
- ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336]
- ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336]
- ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336]
- dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938]
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056}
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216}
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419}
- x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.15.1.el9_8]" date="1781092800">- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037}
- net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.16.1.el9_8]" date="1781611200">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308]
- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048]
- gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056}
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699]
- mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175820]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.17.1" date="1782216000">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="cfe9eef0790c9c8a014019af570e5b55c6a4331f74bdd66c08d25eaac50e4949" name="kernel-rt-64k-devel" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.22.1.el9_8"/>
  <changelog author="Tanishi Srivastava &lt;tsrivast@redhat.com&gt; [5.14.0-687.14.1.el9_8]" date="1781006400">- RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181}
- redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501}
- RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852}
- netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116}
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526]
- ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336]
- ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336]
- ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336]
- dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938]
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056}
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216}
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419}
- x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.15.1.el9_8]" date="1781092800">- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037}
- net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.16.1.el9_8]" date="1781611200">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308]
- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048]
- gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056}
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699]
- mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175820]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.22.1" date="1783339201">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="6b81a37b0cd5d3c6a63941c2ec8c6455f521537f0b626c54292a7440759daf71" name="kernel-rt-64k-devel" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.24.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.16.1.el9_8]" date="1781611200">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308]
- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048]
- gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056}
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699]
- mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175820]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.24.1" date="1783598400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="50ed06413046d43cba03e968127cc3c310e829c1b5264ed8a7d8c1117cda8e4e" name="kernel-rt-64k-devel" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.25.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.25.1" date="1783944000">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="0a738914e2786dbb0ffe869e8e4430249f23f900d5818fa40ba86424da6fcae3" name="kernel-rt-64k-devel" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.26.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.26.1.el9_8]" date="1783944000">- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.26.1" date="1784030400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="f4afea725601cfa36d33039ac640a32cf77a75bd1e29fa77f2eea2910c4cd8c4" name="kernel-rt-64k-devel" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.29.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [5.14.0-687.26.1.el9_8]" date="1784030400">- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.27.1.el9_8]" date="1784203200">- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886]
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113}
- crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943]
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110}
- net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121]
- net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121]
- net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121]
- net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121]
- net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121]
- net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121]
- net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121]
- net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121]
- net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121]
- net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121]
- net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix deadlock between devlink lock and esw-&gt;wq (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121]
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121]
- net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121]
- net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121]
- net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121]
- IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121]
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071}
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980]
- libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.28.1.el9_8]" date="1784548800">- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.29.1.el9_8]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685]
- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061]
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099}
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.29.1" date="1784721600">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="02a04f51910b27142f36cad90052c1cef6ad327ea083d9c46c492725868d5e77" name="kernel-rt-64k-modules" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.10.1.el9_8.0.1"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.3.1.el9_8]" date="1774008000">- HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818}
- NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415]
- perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340]
- perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340]
- perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340]
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193}
- nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552]
- redhat: genlog: add new JIRA cloud server hostname (Jan Stancek)
- gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055]
- io_uring: graduate to full support (Jeff Moyer) [RHEL-120699]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231}
- net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180}
- net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424]
- macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227]
- macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209}
- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814]
- migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.4.1.el9_8]" date="1774612800">- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144}
- ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365]
- libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611]
- libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611]
- libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611]
- libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611]
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611]
- libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611]
- redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611]
- redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611]
- crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611]
- ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210}
- smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396]
- wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.5.1.el9_8]" date="1775044800">- kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672]
- kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672]
- RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243}
- net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109}
- iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.6.1.el9_8]" date="1776340800">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402}
- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741}
- smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988]
- ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378]
- RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966]
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207]
- ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095]
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.10.1" date="1779278400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@resf.org&gt; - 5.14.0-687.10.1.0.1" date="1779537600">- Bump release for rebuild with updated rocky-sb-certs</changelog>
</package>
<package pkgid="bacfb03e852a157daaf382e65d058de1fb52c83667234a6cfd1db2abc0f6f8ae" name="kernel-rt-64k-modules" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.12.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.4.1.el9_8]" date="1774612800">- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144}
- ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365]
- libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611]
- libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611]
- libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611]
- libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611]
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611]
- libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611]
- redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611]
- redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611]
- crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611]
- ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210}
- smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396]
- wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.5.1.el9_8]" date="1775044800">- kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672]
- kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672]
- RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243}
- net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109}
- iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.6.1.el9_8]" date="1776340800">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402}
- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741}
- smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988]
- ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378]
- RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966]
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207]
- ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095]
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.11.1.el9_8]" date="1779192000">- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
- ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
- ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
- ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
- ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
- ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
- ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
- nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
- x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
- ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
- ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
- Revert "mm: pcp: increase pcp-&gt;free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.12.1.el9_8]" date="1779710400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.12.1" date="1779969600">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="282a9170055a1495c56686fb532fd4267d650fe69a198fe1edc4e427a377aa88" name="kernel-rt-64k-modules" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.15.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.11.1.el9_8]" date="1779192000">- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
- ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
- ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
- ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
- ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
- ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
- ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
- nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
- x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
- ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
- ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
- Revert "mm: pcp: increase pcp-&gt;free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.12.1.el9_8]" date="1779710400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.13.1.el9_8]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243}
- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472]
- nvme: nvme-fc: Ensure -&gt;ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786}
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167]
- crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613}
- mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778]
- mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778]
- mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778]
- mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778]
- mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778]
- mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778]
- mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778]</changelog>
  <changelog author="Tanishi Srivastava &lt;tsrivast@redhat.com&gt; [5.14.0-687.14.1.el9_8]" date="1781006400">- RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181}
- redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501}
- RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852}
- netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116}
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526]
- ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336]
- ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336]
- ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336]
- dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938]
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056}
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216}
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419}
- x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.15.1.el9_8]" date="1781092800">- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037}
- net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.15.1" date="1781179200">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="6fa054a541e6e6c019ad8e958116e69888e13b9e03b2410b8a9dabf482f807f7" name="kernel-rt-64k-modules" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.17.1.el9_8"/>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.11.1.el9_8]" date="1779192000">- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
- ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
- ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
- ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
- ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
- ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
- ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
- nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
- x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
- ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
- ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
- Revert "mm: pcp: increase pcp-&gt;free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.12.1.el9_8]" date="1779710400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.13.1.el9_8]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243}
- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472]
- nvme: nvme-fc: Ensure -&gt;ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786}
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167]
- crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613}
- mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778]
- mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778]
- mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778]
- mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778]
- mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778]
- mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778]
- mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778]</changelog>
  <changelog author="Tanishi Srivastava &lt;tsrivast@redhat.com&gt; [5.14.0-687.14.1.el9_8]" date="1781006400">- RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181}
- redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501}
- RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852}
- netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116}
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526]
- ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336]
- ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336]
- ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336]
- dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938]
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056}
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216}
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419}
- x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.15.1.el9_8]" date="1781092800">- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037}
- net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.16.1.el9_8]" date="1781611200">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308]
- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048]
- gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056}
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699]
- mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175820]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.17.1" date="1782216000">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="dba45029cf1b046867b3dea7f57cf922388689ebcbb49e91f60dd681a4d44b70" name="kernel-rt-64k-modules" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.22.1.el9_8"/>
  <changelog author="Tanishi Srivastava &lt;tsrivast@redhat.com&gt; [5.14.0-687.14.1.el9_8]" date="1781006400">- RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181}
- redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501}
- RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852}
- netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116}
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526]
- ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336]
- ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336]
- ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336]
- dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938]
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056}
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216}
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419}
- x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.15.1.el9_8]" date="1781092800">- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037}
- net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.16.1.el9_8]" date="1781611200">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308]
- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048]
- gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056}
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699]
- mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175820]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.22.1" date="1783339201">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="15942f23424a8c592c70e691358d47523dd0b16ca7e8bfce3a0b4a675100a316" name="kernel-rt-64k-modules" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.24.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.16.1.el9_8]" date="1781611200">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308]
- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048]
- gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056}
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699]
- mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175820]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.24.1" date="1783598400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="dbebed16a778003b3cbb21863833b1670b1c8094752e7cce05276414f7863c3c" name="kernel-rt-64k-modules" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.25.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.25.1" date="1783944000">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="dde8c38ccb89b39da42b4092756bc33fbfd00351f1f6cb7eeeca10e682bea9f2" name="kernel-rt-64k-modules" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.26.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.26.1.el9_8]" date="1783944000">- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.26.1" date="1784030400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="cb0c3f2d0b7e56fcc07123e8ee320b2f33db880ce8df4fd710982ba2d014f941" name="kernel-rt-64k-modules" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.29.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [5.14.0-687.26.1.el9_8]" date="1784030400">- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.27.1.el9_8]" date="1784203200">- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886]
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113}
- crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943]
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110}
- net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121]
- net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121]
- net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121]
- net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121]
- net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121]
- net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121]
- net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121]
- net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121]
- net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121]
- net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121]
- net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix deadlock between devlink lock and esw-&gt;wq (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121]
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121]
- net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121]
- net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121]
- net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121]
- IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121]
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071}
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980]
- libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.28.1.el9_8]" date="1784548800">- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.29.1.el9_8]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685]
- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061]
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099}
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.29.1" date="1784721600">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="73005310d015d59085e2cf9ea1a08231d5e64154851be12d0c3a747b0c84c6f4" name="kernel-rt-64k-modules-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.10.1.el9_8.0.1"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.3.1.el9_8]" date="1774008000">- HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818}
- NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415]
- perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340]
- perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340]
- perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340]
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193}
- nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552]
- redhat: genlog: add new JIRA cloud server hostname (Jan Stancek)
- gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055]
- io_uring: graduate to full support (Jeff Moyer) [RHEL-120699]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231}
- net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180}
- net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424]
- macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227]
- macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209}
- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814]
- migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.4.1.el9_8]" date="1774612800">- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144}
- ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365]
- libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611]
- libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611]
- libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611]
- libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611]
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611]
- libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611]
- redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611]
- redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611]
- crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611]
- ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210}
- smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396]
- wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.5.1.el9_8]" date="1775044800">- kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672]
- kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672]
- RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243}
- net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109}
- iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.6.1.el9_8]" date="1776340800">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402}
- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741}
- smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988]
- ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378]
- RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966]
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207]
- ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095]
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.10.1" date="1779278400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@resf.org&gt; - 5.14.0-687.10.1.0.1" date="1779537600">- Bump release for rebuild with updated rocky-sb-certs</changelog>
</package>
<package pkgid="4b50e5b5a217a4d249d117cd8fd5813b1a9f374faec255260eaabc9c5b8380a8" name="kernel-rt-64k-modules-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.12.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.4.1.el9_8]" date="1774612800">- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144}
- ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365]
- libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611]
- libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611]
- libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611]
- libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611]
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611]
- libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611]
- redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611]
- redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611]
- crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611]
- ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210}
- smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396]
- wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.5.1.el9_8]" date="1775044800">- kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672]
- kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672]
- RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243}
- net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109}
- iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.6.1.el9_8]" date="1776340800">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402}
- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741}
- smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988]
- ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378]
- RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966]
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207]
- ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095]
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.11.1.el9_8]" date="1779192000">- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
- ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
- ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
- ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
- ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
- ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
- ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
- nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
- x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
- ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
- ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
- Revert "mm: pcp: increase pcp-&gt;free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.12.1.el9_8]" date="1779710400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.12.1" date="1779969600">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="3d7421c312fcfa5fcae416098ff5f128f86106912bc8fed280258d472ef399fc" name="kernel-rt-64k-modules-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.15.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.11.1.el9_8]" date="1779192000">- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
- ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
- ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
- ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
- ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
- ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
- ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
- nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
- x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
- ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
- ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
- Revert "mm: pcp: increase pcp-&gt;free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.12.1.el9_8]" date="1779710400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.13.1.el9_8]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243}
- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472]
- nvme: nvme-fc: Ensure -&gt;ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786}
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167]
- crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613}
- mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778]
- mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778]
- mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778]
- mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778]
- mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778]
- mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778]
- mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778]</changelog>
  <changelog author="Tanishi Srivastava &lt;tsrivast@redhat.com&gt; [5.14.0-687.14.1.el9_8]" date="1781006400">- RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181}
- redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501}
- RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852}
- netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116}
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526]
- ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336]
- ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336]
- ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336]
- dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938]
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056}
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216}
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419}
- x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.15.1.el9_8]" date="1781092800">- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037}
- net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.15.1" date="1781179200">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="0caa783705216c395ba52102f3bbbfb341052241399150f5e3a40bd9b8be145e" name="kernel-rt-64k-modules-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.17.1.el9_8"/>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.11.1.el9_8]" date="1779192000">- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
- ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
- ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
- ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
- ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
- ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
- ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
- nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
- x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
- ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
- ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
- Revert "mm: pcp: increase pcp-&gt;free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.12.1.el9_8]" date="1779710400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.13.1.el9_8]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243}
- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472]
- nvme: nvme-fc: Ensure -&gt;ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786}
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167]
- crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613}
- mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778]
- mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778]
- mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778]
- mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778]
- mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778]
- mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778]
- mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778]</changelog>
  <changelog author="Tanishi Srivastava &lt;tsrivast@redhat.com&gt; [5.14.0-687.14.1.el9_8]" date="1781006400">- RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181}
- redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501}
- RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852}
- netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116}
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526]
- ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336]
- ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336]
- ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336]
- dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938]
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056}
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216}
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419}
- x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.15.1.el9_8]" date="1781092800">- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037}
- net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.16.1.el9_8]" date="1781611200">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308]
- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048]
- gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056}
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699]
- mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175820]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.17.1" date="1782216000">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="dc47378dfb38fe9d6c4056f99d0be33afd84d11eeda26a9d045fdd288b84bec9" name="kernel-rt-64k-modules-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.22.1.el9_8"/>
  <changelog author="Tanishi Srivastava &lt;tsrivast@redhat.com&gt; [5.14.0-687.14.1.el9_8]" date="1781006400">- RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181}
- redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501}
- RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852}
- netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116}
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526]
- ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336]
- ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336]
- ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336]
- dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938]
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056}
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216}
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419}
- x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.15.1.el9_8]" date="1781092800">- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037}
- net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.16.1.el9_8]" date="1781611200">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308]
- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048]
- gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056}
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699]
- mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175820]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.22.1" date="1783339201">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="8cdd1af23a26350d9c3dd1e3c6fd16d7633c3f10dfc0dcd62f16353434b16c7e" name="kernel-rt-64k-modules-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.24.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.16.1.el9_8]" date="1781611200">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308]
- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048]
- gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056}
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699]
- mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175820]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.24.1" date="1783598400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="db6f8e6d43279240655492f851e3bd34cd78778279c9494f24b0463a8cb285d6" name="kernel-rt-64k-modules-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.25.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.25.1" date="1783944000">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="85bf21f2ca88e5fcbc1975f23b9a08fbcae57b30caa4f00cedc1dcae3df68019" name="kernel-rt-64k-modules-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.26.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.26.1.el9_8]" date="1783944000">- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.26.1" date="1784030400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="5c49925c136f93627b00d2ddb90f716439022f368fbe7ae290d2480a28701550" name="kernel-rt-64k-modules-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.29.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [5.14.0-687.26.1.el9_8]" date="1784030400">- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.27.1.el9_8]" date="1784203200">- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886]
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113}
- crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943]
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110}
- net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121]
- net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121]
- net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121]
- net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121]
- net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121]
- net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121]
- net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121]
- net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121]
- net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121]
- net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121]
- net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix deadlock between devlink lock and esw-&gt;wq (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121]
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121]
- net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121]
- net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121]
- net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121]
- IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121]
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071}
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980]
- libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.28.1.el9_8]" date="1784548800">- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.29.1.el9_8]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685]
- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061]
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099}
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.29.1" date="1784721600">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="490ee6e8e654a9158e4baa8b3aa420a1f0c963ff0b679d0f4e37891aa1e603db" name="kernel-rt-64k-modules-extra" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.10.1.el9_8.0.1"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.3.1.el9_8]" date="1774008000">- HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818}
- NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415]
- perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340]
- perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340]
- perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340]
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193}
- nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552]
- redhat: genlog: add new JIRA cloud server hostname (Jan Stancek)
- gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055]
- io_uring: graduate to full support (Jeff Moyer) [RHEL-120699]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231}
- net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180}
- net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424]
- macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227]
- macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209}
- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814]
- migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.4.1.el9_8]" date="1774612800">- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144}
- ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365]
- libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611]
- libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611]
- libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611]
- libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611]
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611]
- libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611]
- redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611]
- redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611]
- crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611]
- ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210}
- smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396]
- wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.5.1.el9_8]" date="1775044800">- kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672]
- kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672]
- RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243}
- net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109}
- iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.6.1.el9_8]" date="1776340800">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402}
- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741}
- smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988]
- ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378]
- RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966]
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207]
- ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095]
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.10.1" date="1779278400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@resf.org&gt; - 5.14.0-687.10.1.0.1" date="1779537600">- Bump release for rebuild with updated rocky-sb-certs</changelog>
</package>
<package pkgid="8d7339d9bdf13b6e9f2314b7d9510c93f3cddf4d63cf443119c59202fba87cae" name="kernel-rt-64k-modules-extra" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.12.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.4.1.el9_8]" date="1774612800">- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144}
- ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365]
- libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611]
- libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611]
- libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611]
- libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611]
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611]
- libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611]
- redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611]
- redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611]
- crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611]
- ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210}
- smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396]
- wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.5.1.el9_8]" date="1775044800">- kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672]
- kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672]
- RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243}
- net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109}
- iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.6.1.el9_8]" date="1776340800">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402}
- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741}
- smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988]
- ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378]
- RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966]
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207]
- ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095]
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.11.1.el9_8]" date="1779192000">- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
- ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
- ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
- ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
- ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
- ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
- ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
- nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
- x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
- ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
- ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
- Revert "mm: pcp: increase pcp-&gt;free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.12.1.el9_8]" date="1779710400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.12.1" date="1779969600">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="8a643a7cf63454c39eaa6854110672b7fba5147c66bae84b75b4d532cc04802a" name="kernel-rt-64k-modules-extra" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.15.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.11.1.el9_8]" date="1779192000">- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
- ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
- ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
- ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
- ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
- ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
- ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
- nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
- x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
- ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
- ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
- Revert "mm: pcp: increase pcp-&gt;free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.12.1.el9_8]" date="1779710400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.13.1.el9_8]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243}
- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472]
- nvme: nvme-fc: Ensure -&gt;ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786}
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167]
- crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613}
- mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778]
- mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778]
- mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778]
- mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778]
- mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778]
- mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778]
- mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778]</changelog>
  <changelog author="Tanishi Srivastava &lt;tsrivast@redhat.com&gt; [5.14.0-687.14.1.el9_8]" date="1781006400">- RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181}
- redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501}
- RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852}
- netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116}
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526]
- ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336]
- ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336]
- ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336]
- dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938]
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056}
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216}
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419}
- x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.15.1.el9_8]" date="1781092800">- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037}
- net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.15.1" date="1781179200">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="fd9df2311072d7e64fb53aa66b98e5882af796f8a30492d286123711a63a9cee" name="kernel-rt-64k-modules-extra" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.17.1.el9_8"/>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.11.1.el9_8]" date="1779192000">- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
- ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
- ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
- ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
- ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
- ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
- ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
- nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
- x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
- ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
- ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
- Revert "mm: pcp: increase pcp-&gt;free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.12.1.el9_8]" date="1779710400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.13.1.el9_8]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243}
- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472]
- nvme: nvme-fc: Ensure -&gt;ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786}
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167]
- crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613}
- mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778]
- mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778]
- mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778]
- mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778]
- mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778]
- mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778]
- mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778]</changelog>
  <changelog author="Tanishi Srivastava &lt;tsrivast@redhat.com&gt; [5.14.0-687.14.1.el9_8]" date="1781006400">- RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181}
- redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501}
- RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852}
- netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116}
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526]
- ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336]
- ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336]
- ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336]
- dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938]
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056}
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216}
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419}
- x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.15.1.el9_8]" date="1781092800">- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037}
- net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.16.1.el9_8]" date="1781611200">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308]
- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048]
- gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056}
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699]
- mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175820]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.17.1" date="1782216000">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="505d81d23d564eb5a04d022a0cca3ab04b612639b4ae332171fa370ffcfe567a" name="kernel-rt-64k-modules-extra" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.22.1.el9_8"/>
  <changelog author="Tanishi Srivastava &lt;tsrivast@redhat.com&gt; [5.14.0-687.14.1.el9_8]" date="1781006400">- RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181}
- redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501}
- RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852}
- netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116}
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526]
- ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336]
- ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336]
- ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336]
- dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938]
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056}
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216}
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419}
- x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.15.1.el9_8]" date="1781092800">- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037}
- net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.16.1.el9_8]" date="1781611200">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308]
- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048]
- gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056}
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699]
- mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175820]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.22.1" date="1783339201">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="5d6134862193c4bc6286dec61e2d3916b8f9b826a7fea9084bb2d51e760269f9" name="kernel-rt-64k-modules-extra" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.24.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.16.1.el9_8]" date="1781611200">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308]
- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048]
- gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056}
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699]
- mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175820]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.24.1" date="1783598400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="c53df366b8a051e60892b3d26c7de7cfdc2861fb1d084fef846872d3604bf93e" name="kernel-rt-64k-modules-extra" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.25.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.25.1" date="1783944000">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="25e8ffe2f8a3c3b53bad7bd8a8944b161dd2fae366f7216996024354e68801c2" name="kernel-rt-64k-modules-extra" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.26.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.26.1.el9_8]" date="1783944000">- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.26.1" date="1784030400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="ec4bf897caa254c6a6e6ceb2dbd1f336428bfc74f5877d8bd510364b06d75940" name="kernel-rt-64k-modules-extra" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.29.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [5.14.0-687.26.1.el9_8]" date="1784030400">- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.27.1.el9_8]" date="1784203200">- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886]
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113}
- crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943]
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110}
- net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121]
- net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121]
- net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121]
- net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121]
- net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121]
- net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121]
- net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121]
- net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121]
- net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121]
- net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121]
- net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix deadlock between devlink lock and esw-&gt;wq (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121]
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121]
- net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121]
- net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121]
- net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121]
- IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121]
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071}
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980]
- libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.28.1.el9_8]" date="1784548800">- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.29.1.el9_8]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685]
- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061]
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099}
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.29.1" date="1784721600">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="1d2e4690dd20ce12abea6c4ea310d7d91658235159a631af681e7fb145fa4e03" name="kernel-rt-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.10.1.el9_8.0.1"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.3.1.el9_8]" date="1774008000">- HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818}
- NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415]
- perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340]
- perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340]
- perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340]
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193}
- nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552]
- redhat: genlog: add new JIRA cloud server hostname (Jan Stancek)
- gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055]
- io_uring: graduate to full support (Jeff Moyer) [RHEL-120699]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231}
- net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180}
- net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424]
- macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227]
- macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209}
- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814]
- migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.4.1.el9_8]" date="1774612800">- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144}
- ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365]
- libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611]
- libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611]
- libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611]
- libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611]
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611]
- libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611]
- redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611]
- redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611]
- crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611]
- ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210}
- smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396]
- wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.5.1.el9_8]" date="1775044800">- kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672]
- kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672]
- RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243}
- net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109}
- iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.6.1.el9_8]" date="1776340800">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402}
- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741}
- smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988]
- ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378]
- RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966]
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207]
- ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095]
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.10.1" date="1779278400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@resf.org&gt; - 5.14.0-687.10.1.0.1" date="1779537600">- Bump release for rebuild with updated rocky-sb-certs</changelog>
</package>
<package pkgid="7551fcd411396dbd160cecb2ca69d075ecc375a542e36058188f97b9f5a0b09c" name="kernel-rt-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.12.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.4.1.el9_8]" date="1774612800">- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144}
- ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365]
- libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611]
- libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611]
- libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611]
- libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611]
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611]
- libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611]
- redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611]
- redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611]
- crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611]
- ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210}
- smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396]
- wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.5.1.el9_8]" date="1775044800">- kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672]
- kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672]
- RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243}
- net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109}
- iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.6.1.el9_8]" date="1776340800">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402}
- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741}
- smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988]
- ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378]
- RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966]
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207]
- ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095]
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.11.1.el9_8]" date="1779192000">- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
- ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
- ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
- ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
- ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
- ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
- ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
- nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
- x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
- ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
- ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
- Revert "mm: pcp: increase pcp-&gt;free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.12.1.el9_8]" date="1779710400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.12.1" date="1779969600">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="dc749af49d8f03c4a7e409c146a45699bb2721b932060851d4066e6f3a8bd69e" name="kernel-rt-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.15.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.11.1.el9_8]" date="1779192000">- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
- ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
- ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
- ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
- ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
- ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
- ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
- nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
- x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
- ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
- ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
- Revert "mm: pcp: increase pcp-&gt;free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.12.1.el9_8]" date="1779710400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.13.1.el9_8]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243}
- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472]
- nvme: nvme-fc: Ensure -&gt;ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786}
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167]
- crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613}
- mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778]
- mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778]
- mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778]
- mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778]
- mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778]
- mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778]
- mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778]</changelog>
  <changelog author="Tanishi Srivastava &lt;tsrivast@redhat.com&gt; [5.14.0-687.14.1.el9_8]" date="1781006400">- RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181}
- redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501}
- RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852}
- netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116}
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526]
- ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336]
- ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336]
- ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336]
- dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938]
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056}
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216}
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419}
- x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.15.1.el9_8]" date="1781092800">- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037}
- net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.15.1" date="1781179200">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="380f099e71b8e08297005d8be8f1d89b94ff46ffdbf5fd6ef5f4b3182efbd439" name="kernel-rt-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.24.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.16.1.el9_8]" date="1781611200">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308]
- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048]
- gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056}
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699]
- mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175820]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.24.1" date="1783598400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="49643b3d68cac202db93a5603a5afdf68ebcaa13cb9da971a876f3b10885af57" name="kernel-rt-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.25.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.25.1" date="1783944000">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="5b84c78910d441833be1147f32b87984ec5bba2df1876833f7964cc2259d5f59" name="kernel-rt-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.26.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.26.1.el9_8]" date="1783944000">- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.26.1" date="1784030400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="4215d0fb3d4b09522f1bf2874a299491de60a71d47c790c54ab2004a4351e9cf" name="kernel-rt-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.29.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [5.14.0-687.26.1.el9_8]" date="1784030400">- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.27.1.el9_8]" date="1784203200">- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886]
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113}
- crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943]
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110}
- net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121]
- net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121]
- net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121]
- net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121]
- net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121]
- net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121]
- net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121]
- net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121]
- net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121]
- net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121]
- net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix deadlock between devlink lock and esw-&gt;wq (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121]
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121]
- net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121]
- net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121]
- net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121]
- IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121]
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071}
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980]
- libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.28.1.el9_8]" date="1784548800">- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.29.1.el9_8]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685]
- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061]
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099}
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.29.1" date="1784721600">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="7cab0f8bf3a8d2e5813171bba1f06e41e74dbed9f30497374ca6e6f4be63965e" name="kernel-rt-debug" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.10.1.el9_8.0.1"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.3.1.el9_8]" date="1774008000">- HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818}
- NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415]
- perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340]
- perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340]
- perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340]
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193}
- nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552]
- redhat: genlog: add new JIRA cloud server hostname (Jan Stancek)
- gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055]
- io_uring: graduate to full support (Jeff Moyer) [RHEL-120699]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231}
- net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180}
- net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424]
- macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227]
- macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209}
- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814]
- migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.4.1.el9_8]" date="1774612800">- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144}
- ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365]
- libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611]
- libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611]
- libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611]
- libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611]
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611]
- libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611]
- redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611]
- redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611]
- crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611]
- ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210}
- smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396]
- wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.5.1.el9_8]" date="1775044800">- kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672]
- kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672]
- RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243}
- net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109}
- iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.6.1.el9_8]" date="1776340800">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402}
- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741}
- smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988]
- ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378]
- RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966]
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207]
- ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095]
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.10.1" date="1779278400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@resf.org&gt; - 5.14.0-687.10.1.0.1" date="1779537600">- Bump release for rebuild with updated rocky-sb-certs</changelog>
</package>
<package pkgid="8edd37d77117c792fe2ad4cd5924d7a40aec1d4809b607fb18d70091826e70a4" name="kernel-rt-debug" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.12.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.4.1.el9_8]" date="1774612800">- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144}
- ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365]
- libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611]
- libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611]
- libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611]
- libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611]
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611]
- libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611]
- redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611]
- redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611]
- crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611]
- ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210}
- smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396]
- wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.5.1.el9_8]" date="1775044800">- kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672]
- kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672]
- RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243}
- net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109}
- iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.6.1.el9_8]" date="1776340800">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402}
- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741}
- smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988]
- ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378]
- RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966]
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207]
- ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095]
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.11.1.el9_8]" date="1779192000">- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
- ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
- ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
- ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
- ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
- ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
- ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
- nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
- x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
- ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
- ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
- Revert "mm: pcp: increase pcp-&gt;free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.12.1.el9_8]" date="1779710400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.12.1" date="1779969600">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="ea5fef5e36574c65a6f8473ab638d7bd3952c18867ac547ea92eb82fbcd4dfc0" name="kernel-rt-debug" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.15.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.11.1.el9_8]" date="1779192000">- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
- ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
- ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
- ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
- ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
- ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
- ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
- nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
- x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
- ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
- ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
- Revert "mm: pcp: increase pcp-&gt;free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.12.1.el9_8]" date="1779710400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.13.1.el9_8]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243}
- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472]
- nvme: nvme-fc: Ensure -&gt;ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786}
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167]
- crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613}
- mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778]
- mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778]
- mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778]
- mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778]
- mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778]
- mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778]
- mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778]</changelog>
  <changelog author="Tanishi Srivastava &lt;tsrivast@redhat.com&gt; [5.14.0-687.14.1.el9_8]" date="1781006400">- RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181}
- redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501}
- RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852}
- netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116}
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526]
- ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336]
- ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336]
- ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336]
- dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938]
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056}
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216}
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419}
- x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.15.1.el9_8]" date="1781092800">- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037}
- net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.15.1" date="1781179200">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="4a93588dbb5698f9df9ec1c68e0089a7cf29326d73c5e451b0477515aab0c1a4" name="kernel-rt-debug" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.24.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.16.1.el9_8]" date="1781611200">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308]
- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048]
- gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056}
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699]
- mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175820]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.24.1" date="1783598400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="f20fd9a36f0b71dbf69662d4da9090b5efcdfc1f4bf909b73d0958e7f0d443cf" name="kernel-rt-debug" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.25.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.25.1" date="1783944000">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="40b28d6bdfb7295f91f914e4fa89c937bb2a4ce9cd9bcf8c247864e143fc0684" name="kernel-rt-debug" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.26.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.26.1.el9_8]" date="1783944000">- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.26.1" date="1784030400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="b47716e1a7e3c59da219e50852bc8be0105bfed697a153d232b7f9d6be0b24e2" name="kernel-rt-debug" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.29.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [5.14.0-687.26.1.el9_8]" date="1784030400">- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.27.1.el9_8]" date="1784203200">- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886]
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113}
- crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943]
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110}
- net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121]
- net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121]
- net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121]
- net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121]
- net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121]
- net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121]
- net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121]
- net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121]
- net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121]
- net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121]
- net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix deadlock between devlink lock and esw-&gt;wq (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121]
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121]
- net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121]
- net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121]
- net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121]
- IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121]
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071}
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980]
- libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.28.1.el9_8]" date="1784548800">- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.29.1.el9_8]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685]
- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061]
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099}
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.29.1" date="1784721600">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="c3fbd4c9e990ce4047ae9b5c16a6fa6b30973c69afe0060c7c817721c06583da" name="kernel-rt-debug-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.10.1.el9_8.0.1"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.3.1.el9_8]" date="1774008000">- HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818}
- NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415]
- perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340]
- perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340]
- perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340]
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193}
- nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552]
- redhat: genlog: add new JIRA cloud server hostname (Jan Stancek)
- gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055]
- io_uring: graduate to full support (Jeff Moyer) [RHEL-120699]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231}
- net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180}
- net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424]
- macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227]
- macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209}
- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814]
- migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.4.1.el9_8]" date="1774612800">- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144}
- ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365]
- libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611]
- libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611]
- libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611]
- libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611]
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611]
- libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611]
- redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611]
- redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611]
- crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611]
- ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210}
- smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396]
- wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.5.1.el9_8]" date="1775044800">- kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672]
- kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672]
- RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243}
- net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109}
- iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.6.1.el9_8]" date="1776340800">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402}
- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741}
- smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988]
- ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378]
- RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966]
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207]
- ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095]
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.10.1" date="1779278400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@resf.org&gt; - 5.14.0-687.10.1.0.1" date="1779537600">- Bump release for rebuild with updated rocky-sb-certs</changelog>
</package>
<package pkgid="b66fa23868f698cb300af710f72b3f230cd9e8240c1fc6310c98fc3f6b407e4a" name="kernel-rt-debug-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.12.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.4.1.el9_8]" date="1774612800">- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144}
- ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365]
- libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611]
- libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611]
- libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611]
- libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611]
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611]
- libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611]
- redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611]
- redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611]
- crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611]
- ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210}
- smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396]
- wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.5.1.el9_8]" date="1775044800">- kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672]
- kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672]
- RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243}
- net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109}
- iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.6.1.el9_8]" date="1776340800">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402}
- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741}
- smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988]
- ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378]
- RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966]
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207]
- ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095]
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.11.1.el9_8]" date="1779192000">- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
- ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
- ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
- ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
- ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
- ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
- ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
- nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
- x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
- ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
- ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
- Revert "mm: pcp: increase pcp-&gt;free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.12.1.el9_8]" date="1779710400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.12.1" date="1779969600">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="5f4e37c830fe1cf2a06f443cb1c7b95f68eac34d7471c4eddc9ae770a589f686" name="kernel-rt-debug-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.15.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.11.1.el9_8]" date="1779192000">- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
- ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
- ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
- ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
- ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
- ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
- ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
- nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
- x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
- ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
- ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
- Revert "mm: pcp: increase pcp-&gt;free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.12.1.el9_8]" date="1779710400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.13.1.el9_8]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243}
- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472]
- nvme: nvme-fc: Ensure -&gt;ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786}
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167]
- crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613}
- mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778]
- mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778]
- mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778]
- mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778]
- mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778]
- mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778]
- mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778]</changelog>
  <changelog author="Tanishi Srivastava &lt;tsrivast@redhat.com&gt; [5.14.0-687.14.1.el9_8]" date="1781006400">- RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181}
- redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501}
- RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852}
- netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116}
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526]
- ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336]
- ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336]
- ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336]
- dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938]
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056}
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216}
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419}
- x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.15.1.el9_8]" date="1781092800">- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037}
- net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.15.1" date="1781179200">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="a971175bac0ce12c6be13d1eb3a5e03c8c4c0d647108acd5cffc549ab5f6d2f2" name="kernel-rt-debug-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.24.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.16.1.el9_8]" date="1781611200">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308]
- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048]
- gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056}
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699]
- mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175820]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.24.1" date="1783598400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="93e791660b50c1037fd558e25b3ed1073d3ff1fa0e819b1c661116c91cba7d67" name="kernel-rt-debug-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.25.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.25.1" date="1783944000">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="18d79972c323d9748d85f1f7e5d090674e373bae50f702f2824d9288957bb0bc" name="kernel-rt-debug-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.26.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.26.1.el9_8]" date="1783944000">- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.26.1" date="1784030400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="48be794eec3b24fb940a801a196f28318603b5296251dd27a66a61d38c8b58fa" name="kernel-rt-debug-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.29.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [5.14.0-687.26.1.el9_8]" date="1784030400">- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.27.1.el9_8]" date="1784203200">- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886]
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113}
- crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943]
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110}
- net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121]
- net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121]
- net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121]
- net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121]
- net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121]
- net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121]
- net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121]
- net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121]
- net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121]
- net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121]
- net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix deadlock between devlink lock and esw-&gt;wq (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121]
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121]
- net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121]
- net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121]
- net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121]
- IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121]
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071}
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980]
- libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.28.1.el9_8]" date="1784548800">- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.29.1.el9_8]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685]
- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061]
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099}
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.29.1" date="1784721600">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="715613b64c7d76f470aabba314feb83c0986a932c52225eb7e42b614a280c13d" name="kernel-rt-debug-devel" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.10.1.el9_8.0.1"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.3.1.el9_8]" date="1774008000">- HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818}
- NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415]
- perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340]
- perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340]
- perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340]
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193}
- nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552]
- redhat: genlog: add new JIRA cloud server hostname (Jan Stancek)
- gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055]
- io_uring: graduate to full support (Jeff Moyer) [RHEL-120699]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231}
- net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180}
- net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424]
- macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227]
- macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209}
- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814]
- migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.4.1.el9_8]" date="1774612800">- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144}
- ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365]
- libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611]
- libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611]
- libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611]
- libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611]
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611]
- libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611]
- redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611]
- redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611]
- crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611]
- ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210}
- smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396]
- wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.5.1.el9_8]" date="1775044800">- kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672]
- kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672]
- RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243}
- net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109}
- iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.6.1.el9_8]" date="1776340800">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402}
- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741}
- smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988]
- ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378]
- RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966]
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207]
- ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095]
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.10.1" date="1779278400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@resf.org&gt; - 5.14.0-687.10.1.0.1" date="1779537600">- Bump release for rebuild with updated rocky-sb-certs</changelog>
</package>
<package pkgid="c30d5245152277376e7846e0331a3205d6b866e01234d478bc68441de1b57e84" name="kernel-rt-debug-devel" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.12.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.4.1.el9_8]" date="1774612800">- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144}
- ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365]
- libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611]
- libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611]
- libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611]
- libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611]
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611]
- libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611]
- redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611]
- redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611]
- crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611]
- ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210}
- smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396]
- wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.5.1.el9_8]" date="1775044800">- kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672]
- kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672]
- RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243}
- net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109}
- iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.6.1.el9_8]" date="1776340800">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402}
- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741}
- smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988]
- ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378]
- RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966]
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207]
- ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095]
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.11.1.el9_8]" date="1779192000">- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
- ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
- ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
- ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
- ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
- ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
- ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
- nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
- x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
- ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
- ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
- Revert "mm: pcp: increase pcp-&gt;free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.12.1.el9_8]" date="1779710400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.12.1" date="1779969600">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="66841913df51ddb2e0946bd36a3ef0722d84d92b898058da9729227e9491b787" name="kernel-rt-debug-devel" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.15.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.11.1.el9_8]" date="1779192000">- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
- ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
- ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
- ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
- ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
- ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
- ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
- nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
- x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
- ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
- ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
- Revert "mm: pcp: increase pcp-&gt;free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.12.1.el9_8]" date="1779710400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.13.1.el9_8]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243}
- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472]
- nvme: nvme-fc: Ensure -&gt;ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786}
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167]
- crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613}
- mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778]
- mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778]
- mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778]
- mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778]
- mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778]
- mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778]
- mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778]</changelog>
  <changelog author="Tanishi Srivastava &lt;tsrivast@redhat.com&gt; [5.14.0-687.14.1.el9_8]" date="1781006400">- RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181}
- redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501}
- RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852}
- netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116}
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526]
- ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336]
- ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336]
- ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336]
- dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938]
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056}
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216}
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419}
- x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.15.1.el9_8]" date="1781092800">- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037}
- net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.15.1" date="1781179200">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="8a89a305a6bac0451802b0afe31b20645d880defefb1bb4326fe134d0f5916f7" name="kernel-rt-debug-devel" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.24.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.16.1.el9_8]" date="1781611200">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308]
- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048]
- gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056}
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699]
- mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175820]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.24.1" date="1783598400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="383dcd58b0a746e4d430ff19c029db0232486ef0ab37c8bffba02df626137a26" name="kernel-rt-debug-devel" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.25.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.25.1" date="1783944000">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="ee7d88f5fc7015318ee4b0ccf31ae0e7f2ccb01d8520b74f53da7c46c7c215bd" name="kernel-rt-debug-devel" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.26.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.26.1.el9_8]" date="1783944000">- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.26.1" date="1784030400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="f2c09d299ab8c60bcbddb577c59b0d98cc7a49e5fca039527f64a4290b4b39e9" name="kernel-rt-debug-devel" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.29.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [5.14.0-687.26.1.el9_8]" date="1784030400">- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.27.1.el9_8]" date="1784203200">- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886]
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113}
- crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943]
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110}
- net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121]
- net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121]
- net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121]
- net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121]
- net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121]
- net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121]
- net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121]
- net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121]
- net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121]
- net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121]
- net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix deadlock between devlink lock and esw-&gt;wq (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121]
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121]
- net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121]
- net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121]
- net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121]
- IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121]
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071}
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980]
- libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.28.1.el9_8]" date="1784548800">- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.29.1.el9_8]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685]
- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061]
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099}
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.29.1" date="1784721600">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="55ea7468da314c2e1fd68c40cf7d40cba7fc169d9fe748a7544ede4267e43462" name="kernel-rt-debug-modules" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.10.1.el9_8.0.1"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.3.1.el9_8]" date="1774008000">- HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818}
- NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415]
- perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340]
- perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340]
- perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340]
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193}
- nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552]
- redhat: genlog: add new JIRA cloud server hostname (Jan Stancek)
- gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055]
- io_uring: graduate to full support (Jeff Moyer) [RHEL-120699]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231}
- net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180}
- net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424]
- macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227]
- macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209}
- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814]
- migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.4.1.el9_8]" date="1774612800">- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144}
- ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365]
- libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611]
- libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611]
- libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611]
- libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611]
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611]
- libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611]
- redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611]
- redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611]
- crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611]
- ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210}
- smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396]
- wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.5.1.el9_8]" date="1775044800">- kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672]
- kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672]
- RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243}
- net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109}
- iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.6.1.el9_8]" date="1776340800">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402}
- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741}
- smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988]
- ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378]
- RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966]
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207]
- ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095]
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.10.1" date="1779278400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@resf.org&gt; - 5.14.0-687.10.1.0.1" date="1779537600">- Bump release for rebuild with updated rocky-sb-certs</changelog>
</package>
<package pkgid="385b033e7a576d9c3db32689290951c0d1213c9cdcc1c412adb6cd086d891fb6" name="kernel-rt-debug-modules" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.12.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.4.1.el9_8]" date="1774612800">- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144}
- ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365]
- libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611]
- libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611]
- libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611]
- libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611]
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611]
- libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611]
- redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611]
- redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611]
- crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611]
- ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210}
- smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396]
- wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.5.1.el9_8]" date="1775044800">- kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672]
- kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672]
- RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243}
- net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109}
- iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.6.1.el9_8]" date="1776340800">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402}
- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741}
- smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988]
- ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378]
- RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966]
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207]
- ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095]
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.11.1.el9_8]" date="1779192000">- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
- ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
- ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
- ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
- ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
- ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
- ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
- nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
- x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
- ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
- ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
- Revert "mm: pcp: increase pcp-&gt;free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.12.1.el9_8]" date="1779710400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.12.1" date="1779969600">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="7ac512f19fce1caed58c96507ba76483285fa540e83ee00a9747fbf7a1f8532f" name="kernel-rt-debug-modules" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.15.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.11.1.el9_8]" date="1779192000">- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
- ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
- ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
- ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
- ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
- ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
- ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
- nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
- x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
- ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
- ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
- Revert "mm: pcp: increase pcp-&gt;free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.12.1.el9_8]" date="1779710400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.13.1.el9_8]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243}
- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472]
- nvme: nvme-fc: Ensure -&gt;ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786}
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167]
- crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613}
- mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778]
- mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778]
- mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778]
- mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778]
- mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778]
- mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778]
- mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778]</changelog>
  <changelog author="Tanishi Srivastava &lt;tsrivast@redhat.com&gt; [5.14.0-687.14.1.el9_8]" date="1781006400">- RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181}
- redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501}
- RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852}
- netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116}
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526]
- ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336]
- ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336]
- ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336]
- dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938]
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056}
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216}
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419}
- x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.15.1.el9_8]" date="1781092800">- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037}
- net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.15.1" date="1781179200">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="a2113b3dfd9e1ed64e6a2020e3f236e2c1fa611f1def1e78497f6be23848b372" name="kernel-rt-debug-modules" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.24.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.16.1.el9_8]" date="1781611200">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308]
- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048]
- gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056}
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699]
- mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175820]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.24.1" date="1783598400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="99e575f8747f6036b3341cb0172c08c363e3370d1c47b1c321315d63240ce76d" name="kernel-rt-debug-modules" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.25.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.25.1" date="1783944000">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="631be7303386eb923897580a0c16921c729de0d42b2567cc794f21a531ed73ce" name="kernel-rt-debug-modules" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.26.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.26.1.el9_8]" date="1783944000">- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.26.1" date="1784030400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="7c60306a0a708d27a4604b5e86467e8f8606818f43c2b006fe54c3da298338e0" name="kernel-rt-debug-modules" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.29.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [5.14.0-687.26.1.el9_8]" date="1784030400">- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.27.1.el9_8]" date="1784203200">- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886]
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113}
- crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943]
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110}
- net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121]
- net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121]
- net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121]
- net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121]
- net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121]
- net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121]
- net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121]
- net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121]
- net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121]
- net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121]
- net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix deadlock between devlink lock and esw-&gt;wq (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121]
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121]
- net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121]
- net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121]
- net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121]
- IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121]
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071}
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980]
- libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.28.1.el9_8]" date="1784548800">- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.29.1.el9_8]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685]
- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061]
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099}
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.29.1" date="1784721600">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="8e15d6b9063385ba19c9e02fba23537650d3a083345a0ee5604b2678896a66e8" name="kernel-rt-debug-modules-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.10.1.el9_8.0.1"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.3.1.el9_8]" date="1774008000">- HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818}
- NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415]
- perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340]
- perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340]
- perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340]
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193}
- nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552]
- redhat: genlog: add new JIRA cloud server hostname (Jan Stancek)
- gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055]
- io_uring: graduate to full support (Jeff Moyer) [RHEL-120699]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231}
- net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180}
- net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424]
- macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227]
- macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209}
- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814]
- migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.4.1.el9_8]" date="1774612800">- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144}
- ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365]
- libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611]
- libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611]
- libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611]
- libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611]
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611]
- libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611]
- redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611]
- redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611]
- crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611]
- ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210}
- smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396]
- wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.5.1.el9_8]" date="1775044800">- kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672]
- kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672]
- RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243}
- net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109}
- iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.6.1.el9_8]" date="1776340800">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402}
- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741}
- smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988]
- ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378]
- RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966]
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207]
- ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095]
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.10.1" date="1779278400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@resf.org&gt; - 5.14.0-687.10.1.0.1" date="1779537600">- Bump release for rebuild with updated rocky-sb-certs</changelog>
</package>
<package pkgid="68556808d59d1481a66a8f629703697b7c8f8986d5ea6903ca5d7ab48161bcac" name="kernel-rt-debug-modules-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.12.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.4.1.el9_8]" date="1774612800">- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144}
- ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365]
- libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611]
- libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611]
- libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611]
- libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611]
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611]
- libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611]
- redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611]
- redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611]
- crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611]
- ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210}
- smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396]
- wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.5.1.el9_8]" date="1775044800">- kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672]
- kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672]
- RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243}
- net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109}
- iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.6.1.el9_8]" date="1776340800">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402}
- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741}
- smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988]
- ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378]
- RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966]
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207]
- ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095]
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.11.1.el9_8]" date="1779192000">- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
- ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
- ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
- ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
- ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
- ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
- ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
- nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
- x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
- ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
- ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
- Revert "mm: pcp: increase pcp-&gt;free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.12.1.el9_8]" date="1779710400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.12.1" date="1779969600">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="12133fc29fe3d9d080c41cb8c2cb150642761dedd99b54c39fab7bade2661ddd" name="kernel-rt-debug-modules-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.15.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.11.1.el9_8]" date="1779192000">- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
- ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
- ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
- ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
- ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
- ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
- ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
- nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
- x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
- ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
- ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
- Revert "mm: pcp: increase pcp-&gt;free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.12.1.el9_8]" date="1779710400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.13.1.el9_8]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243}
- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472]
- nvme: nvme-fc: Ensure -&gt;ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786}
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167]
- crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613}
- mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778]
- mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778]
- mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778]
- mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778]
- mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778]
- mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778]
- mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778]</changelog>
  <changelog author="Tanishi Srivastava &lt;tsrivast@redhat.com&gt; [5.14.0-687.14.1.el9_8]" date="1781006400">- RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181}
- redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501}
- RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852}
- netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116}
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526]
- ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336]
- ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336]
- ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336]
- dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938]
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056}
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216}
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419}
- x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.15.1.el9_8]" date="1781092800">- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037}
- net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.15.1" date="1781179200">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="135f58d465e021f57e48488af01381e56c8d7624f501b27132d27efb9a3b7d6a" name="kernel-rt-debug-modules-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.24.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.16.1.el9_8]" date="1781611200">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308]
- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048]
- gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056}
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699]
- mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175820]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.24.1" date="1783598400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="179b81bcba507d5e368219d48f1811c508a621c3ef7e462bf0471e442426dcb7" name="kernel-rt-debug-modules-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.25.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.25.1" date="1783944000">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="07477b58ae8208dd9c7e8167f8a2b08c32add6bb616a7df24f1fa56ef109d073" name="kernel-rt-debug-modules-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.26.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.26.1.el9_8]" date="1783944000">- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.26.1" date="1784030400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="99a6d3bc165392304d82507073755d550c1cb18330cb5c031f77c702743161ba" name="kernel-rt-debug-modules-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.29.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [5.14.0-687.26.1.el9_8]" date="1784030400">- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.27.1.el9_8]" date="1784203200">- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886]
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113}
- crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943]
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110}
- net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121]
- net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121]
- net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121]
- net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121]
- net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121]
- net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121]
- net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121]
- net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121]
- net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121]
- net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121]
- net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix deadlock between devlink lock and esw-&gt;wq (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121]
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121]
- net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121]
- net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121]
- net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121]
- IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121]
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071}
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980]
- libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.28.1.el9_8]" date="1784548800">- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.29.1.el9_8]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685]
- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061]
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099}
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.29.1" date="1784721600">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="2602969eeef9e1cdfcdeb31e1eece2016757599da782f4af149c4ba2479a4700" name="kernel-rt-debug-modules-extra" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.10.1.el9_8.0.1"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.3.1.el9_8]" date="1774008000">- HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818}
- NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415]
- perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340]
- perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340]
- perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340]
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193}
- nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552]
- redhat: genlog: add new JIRA cloud server hostname (Jan Stancek)
- gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055]
- io_uring: graduate to full support (Jeff Moyer) [RHEL-120699]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231}
- net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180}
- net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424]
- macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227]
- macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209}
- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814]
- migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.4.1.el9_8]" date="1774612800">- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144}
- ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365]
- libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611]
- libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611]
- libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611]
- libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611]
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611]
- libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611]
- redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611]
- redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611]
- crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611]
- ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210}
- smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396]
- wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.5.1.el9_8]" date="1775044800">- kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672]
- kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672]
- RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243}
- net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109}
- iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.6.1.el9_8]" date="1776340800">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402}
- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741}
- smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988]
- ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378]
- RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966]
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207]
- ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095]
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.10.1" date="1779278400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@resf.org&gt; - 5.14.0-687.10.1.0.1" date="1779537600">- Bump release for rebuild with updated rocky-sb-certs</changelog>
</package>
<package pkgid="eb7d2155a509c07c6dfee3b4ceb4b98d6c56259116580b4264c21ba69468e4c8" name="kernel-rt-debug-modules-extra" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.12.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.4.1.el9_8]" date="1774612800">- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144}
- ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365]
- libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611]
- libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611]
- libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611]
- libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611]
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611]
- libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611]
- redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611]
- redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611]
- crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611]
- ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210}
- smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396]
- wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.5.1.el9_8]" date="1775044800">- kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672]
- kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672]
- RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243}
- net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109}
- iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.6.1.el9_8]" date="1776340800">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402}
- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741}
- smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988]
- ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378]
- RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966]
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207]
- ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095]
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.11.1.el9_8]" date="1779192000">- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
- ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
- ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
- ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
- ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
- ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
- ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
- nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
- x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
- ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
- ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
- Revert "mm: pcp: increase pcp-&gt;free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.12.1.el9_8]" date="1779710400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.12.1" date="1779969600">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="4d4e900a2537dde9af536113c8ec0576bb0987caa1346ffff572f5ad6c9315ac" name="kernel-rt-debug-modules-extra" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.15.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.11.1.el9_8]" date="1779192000">- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
- ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
- ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
- ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
- ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
- ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
- ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
- nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
- x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
- ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
- ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
- Revert "mm: pcp: increase pcp-&gt;free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.12.1.el9_8]" date="1779710400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.13.1.el9_8]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243}
- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472]
- nvme: nvme-fc: Ensure -&gt;ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786}
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167]
- crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613}
- mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778]
- mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778]
- mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778]
- mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778]
- mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778]
- mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778]
- mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778]</changelog>
  <changelog author="Tanishi Srivastava &lt;tsrivast@redhat.com&gt; [5.14.0-687.14.1.el9_8]" date="1781006400">- RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181}
- redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501}
- RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852}
- netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116}
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526]
- ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336]
- ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336]
- ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336]
- dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938]
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056}
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216}
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419}
- x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.15.1.el9_8]" date="1781092800">- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037}
- net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.15.1" date="1781179200">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="2b8030e8082581ca332df7288c096526f8add1646676453a94dc49dc0b331ec7" name="kernel-rt-debug-modules-extra" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.24.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.16.1.el9_8]" date="1781611200">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308]
- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048]
- gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056}
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699]
- mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175820]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.24.1" date="1783598400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="d367bab8df75116d5e32e462c38a62208c66fb4c8e9bdf729b9bb5f9a06e3d31" name="kernel-rt-debug-modules-extra" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.25.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.25.1" date="1783944000">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="ff91625b37a04ae114c012bdfdd64a624b73ff87facd4a116a9ca669835bc92b" name="kernel-rt-debug-modules-extra" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.26.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.26.1.el9_8]" date="1783944000">- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.26.1" date="1784030400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="e0d8283cbe5fa00b4eff6e8e768c46fa4bef51e2cb47ff4a105b715329cd39a5" name="kernel-rt-debug-modules-extra" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.29.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [5.14.0-687.26.1.el9_8]" date="1784030400">- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.27.1.el9_8]" date="1784203200">- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886]
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113}
- crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943]
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110}
- net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121]
- net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121]
- net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121]
- net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121]
- net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121]
- net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121]
- net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121]
- net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121]
- net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121]
- net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121]
- net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix deadlock between devlink lock and esw-&gt;wq (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121]
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121]
- net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121]
- net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121]
- net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121]
- IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121]
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071}
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980]
- libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.28.1.el9_8]" date="1784548800">- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.29.1.el9_8]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685]
- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061]
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099}
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.29.1" date="1784721600">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="fb8cf196d2bdcc6d7bed9b5fbe350bf6edd94ca60e990fec3b270f7e42683838" name="kernel-rt-devel" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.10.1.el9_8.0.1"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.3.1.el9_8]" date="1774008000">- HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818}
- NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415]
- perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340]
- perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340]
- perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340]
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193}
- nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552]
- redhat: genlog: add new JIRA cloud server hostname (Jan Stancek)
- gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055]
- io_uring: graduate to full support (Jeff Moyer) [RHEL-120699]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231}
- net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180}
- net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424]
- macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227]
- macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209}
- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814]
- migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.4.1.el9_8]" date="1774612800">- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144}
- ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365]
- libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611]
- libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611]
- libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611]
- libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611]
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611]
- libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611]
- redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611]
- redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611]
- crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611]
- ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210}
- smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396]
- wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.5.1.el9_8]" date="1775044800">- kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672]
- kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672]
- RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243}
- net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109}
- iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.6.1.el9_8]" date="1776340800">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402}
- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741}
- smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988]
- ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378]
- RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966]
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207]
- ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095]
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.10.1" date="1779278400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@resf.org&gt; - 5.14.0-687.10.1.0.1" date="1779537600">- Bump release for rebuild with updated rocky-sb-certs</changelog>
</package>
<package pkgid="4f6af8f7dbf10f9ffa2514ecd76f134bf0f27425f3e982bad6e678a6bc4ec2c5" name="kernel-rt-devel" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.12.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.4.1.el9_8]" date="1774612800">- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144}
- ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365]
- libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611]
- libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611]
- libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611]
- libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611]
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611]
- libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611]
- redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611]
- redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611]
- crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611]
- ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210}
- smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396]
- wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.5.1.el9_8]" date="1775044800">- kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672]
- kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672]
- RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243}
- net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109}
- iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.6.1.el9_8]" date="1776340800">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402}
- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741}
- smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988]
- ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378]
- RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966]
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207]
- ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095]
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.11.1.el9_8]" date="1779192000">- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
- ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
- ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
- ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
- ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
- ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
- ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
- nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
- x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
- ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
- ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
- Revert "mm: pcp: increase pcp-&gt;free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.12.1.el9_8]" date="1779710400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.12.1" date="1779969600">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="c67c53abcdf9b07b9ecb993ddbf536832138327623d310b5282ec6e6cb4beade" name="kernel-rt-devel" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.15.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.11.1.el9_8]" date="1779192000">- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
- ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
- ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
- ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
- ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
- ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
- ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
- nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
- x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
- ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
- ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
- Revert "mm: pcp: increase pcp-&gt;free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.12.1.el9_8]" date="1779710400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.13.1.el9_8]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243}
- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472]
- nvme: nvme-fc: Ensure -&gt;ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786}
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167]
- crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613}
- mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778]
- mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778]
- mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778]
- mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778]
- mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778]
- mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778]
- mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778]</changelog>
  <changelog author="Tanishi Srivastava &lt;tsrivast@redhat.com&gt; [5.14.0-687.14.1.el9_8]" date="1781006400">- RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181}
- redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501}
- RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852}
- netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116}
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526]
- ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336]
- ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336]
- ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336]
- dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938]
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056}
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216}
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419}
- x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.15.1.el9_8]" date="1781092800">- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037}
- net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.15.1" date="1781179200">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="f55d4227d88ee3968420ca2cf6f0cbe77dcdd7b5df72134990645b1b5e4b0634" name="kernel-rt-devel" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.24.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.16.1.el9_8]" date="1781611200">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308]
- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048]
- gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056}
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699]
- mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175820]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.24.1" date="1783598400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="5679b6ec70d0d2b1ea0cbb79eff3bcd7016ad000d8c89fa32a701c183e5e894e" name="kernel-rt-devel" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.25.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.25.1" date="1783944000">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="f97e1d8865ad8003d149fec415be5c4d169b41a2697bcee9e1e3611fba149f29" name="kernel-rt-devel" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.26.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.26.1.el9_8]" date="1783944000">- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.26.1" date="1784030400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="e43721bd62ec428a5b8588e3e091954c05698ca761b4a02161ee8c7b43f51f36" name="kernel-rt-devel" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.29.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [5.14.0-687.26.1.el9_8]" date="1784030400">- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.27.1.el9_8]" date="1784203200">- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886]
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113}
- crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943]
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110}
- net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121]
- net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121]
- net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121]
- net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121]
- net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121]
- net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121]
- net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121]
- net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121]
- net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121]
- net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121]
- net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix deadlock between devlink lock and esw-&gt;wq (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121]
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121]
- net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121]
- net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121]
- net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121]
- IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121]
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071}
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980]
- libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.28.1.el9_8]" date="1784548800">- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.29.1.el9_8]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685]
- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061]
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099}
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.29.1" date="1784721600">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="1a1b6fcd81b5d36b3aa7bf609f58300bf99182f20527070a05f27c75413b36aa" name="kernel-rt-modules" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.10.1.el9_8.0.1"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.3.1.el9_8]" date="1774008000">- HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818}
- NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415]
- perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340]
- perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340]
- perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340]
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193}
- nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552]
- redhat: genlog: add new JIRA cloud server hostname (Jan Stancek)
- gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055]
- io_uring: graduate to full support (Jeff Moyer) [RHEL-120699]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231}
- net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180}
- net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424]
- macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227]
- macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209}
- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814]
- migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.4.1.el9_8]" date="1774612800">- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144}
- ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365]
- libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611]
- libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611]
- libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611]
- libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611]
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611]
- libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611]
- redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611]
- redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611]
- crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611]
- ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210}
- smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396]
- wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.5.1.el9_8]" date="1775044800">- kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672]
- kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672]
- RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243}
- net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109}
- iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.6.1.el9_8]" date="1776340800">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402}
- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741}
- smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988]
- ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378]
- RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966]
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207]
- ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095]
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.10.1" date="1779278400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@resf.org&gt; - 5.14.0-687.10.1.0.1" date="1779537600">- Bump release for rebuild with updated rocky-sb-certs</changelog>
</package>
<package pkgid="1cfee1e4d21faf1987c7f0a8d275492338a7c3402de0d15adb98a8607205d388" name="kernel-rt-modules" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.12.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.4.1.el9_8]" date="1774612800">- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144}
- ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365]
- libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611]
- libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611]
- libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611]
- libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611]
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611]
- libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611]
- redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611]
- redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611]
- crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611]
- ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210}
- smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396]
- wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.5.1.el9_8]" date="1775044800">- kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672]
- kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672]
- RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243}
- net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109}
- iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.6.1.el9_8]" date="1776340800">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402}
- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741}
- smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988]
- ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378]
- RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966]
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207]
- ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095]
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.11.1.el9_8]" date="1779192000">- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
- ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
- ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
- ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
- ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
- ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
- ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
- nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
- x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
- ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
- ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
- Revert "mm: pcp: increase pcp-&gt;free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.12.1.el9_8]" date="1779710400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.12.1" date="1779969600">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="f10eabf694ba3cb3f9bb54fbc9931376f5377abbc3f2b4f0a58840ae3e3a78e6" name="kernel-rt-modules" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.15.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.11.1.el9_8]" date="1779192000">- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
- ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
- ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
- ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
- ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
- ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
- ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
- nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
- x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
- ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
- ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
- Revert "mm: pcp: increase pcp-&gt;free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.12.1.el9_8]" date="1779710400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.13.1.el9_8]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243}
- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472]
- nvme: nvme-fc: Ensure -&gt;ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786}
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167]
- crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613}
- mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778]
- mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778]
- mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778]
- mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778]
- mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778]
- mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778]
- mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778]</changelog>
  <changelog author="Tanishi Srivastava &lt;tsrivast@redhat.com&gt; [5.14.0-687.14.1.el9_8]" date="1781006400">- RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181}
- redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501}
- RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852}
- netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116}
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526]
- ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336]
- ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336]
- ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336]
- dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938]
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056}
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216}
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419}
- x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.15.1.el9_8]" date="1781092800">- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037}
- net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.15.1" date="1781179200">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="2ab8f0299d117b2792e4304c0646fe3ecdd5d4d760b8977f24c1cf1907ee445d" name="kernel-rt-modules" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.24.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.16.1.el9_8]" date="1781611200">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308]
- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048]
- gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056}
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699]
- mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175820]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.24.1" date="1783598400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="e9471619ae1a36b40021f6245b0a014209c2d5b15a7254204a2fa40f0d0c0bb0" name="kernel-rt-modules" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.25.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.25.1" date="1783944000">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="c06680e411fe010505def6c16040f90ba851b4869ae9b1f4ded77ea497048347" name="kernel-rt-modules" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.26.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.26.1.el9_8]" date="1783944000">- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.26.1" date="1784030400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="55eac388541f247e52c01a2cc0ca42d3c8e33909da3452a4604f4cb2cb1bd2c0" name="kernel-rt-modules" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.29.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [5.14.0-687.26.1.el9_8]" date="1784030400">- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.27.1.el9_8]" date="1784203200">- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886]
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113}
- crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943]
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110}
- net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121]
- net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121]
- net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121]
- net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121]
- net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121]
- net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121]
- net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121]
- net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121]
- net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121]
- net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121]
- net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix deadlock between devlink lock and esw-&gt;wq (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121]
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121]
- net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121]
- net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121]
- net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121]
- IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121]
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071}
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980]
- libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.28.1.el9_8]" date="1784548800">- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.29.1.el9_8]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685]
- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061]
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099}
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.29.1" date="1784721600">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="638aedad13e91e355844b4831b0e5419c01c38a6acb7f283cca1b1703cb22cb4" name="kernel-rt-modules-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.10.1.el9_8.0.1"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.3.1.el9_8]" date="1774008000">- HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818}
- NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415]
- perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340]
- perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340]
- perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340]
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193}
- nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552]
- redhat: genlog: add new JIRA cloud server hostname (Jan Stancek)
- gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055]
- io_uring: graduate to full support (Jeff Moyer) [RHEL-120699]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231}
- net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180}
- net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424]
- macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227]
- macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209}
- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814]
- migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.4.1.el9_8]" date="1774612800">- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144}
- ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365]
- libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611]
- libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611]
- libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611]
- libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611]
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611]
- libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611]
- redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611]
- redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611]
- crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611]
- ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210}
- smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396]
- wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.5.1.el9_8]" date="1775044800">- kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672]
- kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672]
- RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243}
- net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109}
- iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.6.1.el9_8]" date="1776340800">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402}
- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741}
- smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988]
- ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378]
- RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966]
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207]
- ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095]
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.10.1" date="1779278400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@resf.org&gt; - 5.14.0-687.10.1.0.1" date="1779537600">- Bump release for rebuild with updated rocky-sb-certs</changelog>
</package>
<package pkgid="c630fd7c8cd9c176c9b1fcb86e3741d498d7e98d462a71c39fd16f013e98b316" name="kernel-rt-modules-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.12.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.4.1.el9_8]" date="1774612800">- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144}
- ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365]
- libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611]
- libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611]
- libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611]
- libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611]
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611]
- libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611]
- redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611]
- redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611]
- crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611]
- ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210}
- smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396]
- wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.5.1.el9_8]" date="1775044800">- kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672]
- kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672]
- RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243}
- net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109}
- iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.6.1.el9_8]" date="1776340800">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402}
- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741}
- smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988]
- ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378]
- RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966]
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207]
- ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095]
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.11.1.el9_8]" date="1779192000">- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
- ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
- ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
- ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
- ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
- ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
- ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
- nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
- x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
- ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
- ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
- Revert "mm: pcp: increase pcp-&gt;free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.12.1.el9_8]" date="1779710400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.12.1" date="1779969600">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="14c1eb67e62fc6f3d0b977eab42d9963e9e9028ee81159a53cdbebb51fe4fde5" name="kernel-rt-modules-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.15.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.11.1.el9_8]" date="1779192000">- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
- ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
- ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
- ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
- ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
- ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
- ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
- nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
- x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
- ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
- ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
- Revert "mm: pcp: increase pcp-&gt;free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.12.1.el9_8]" date="1779710400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.13.1.el9_8]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243}
- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472]
- nvme: nvme-fc: Ensure -&gt;ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786}
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167]
- crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613}
- mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778]
- mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778]
- mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778]
- mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778]
- mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778]
- mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778]
- mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778]</changelog>
  <changelog author="Tanishi Srivastava &lt;tsrivast@redhat.com&gt; [5.14.0-687.14.1.el9_8]" date="1781006400">- RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181}
- redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501}
- RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852}
- netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116}
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526]
- ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336]
- ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336]
- ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336]
- dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938]
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056}
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216}
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419}
- x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.15.1.el9_8]" date="1781092800">- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037}
- net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.15.1" date="1781179200">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="5391d1a1eb0146f4e455a18ffeb1c9ae67b49c17c4d3176d34e30254f65b43b5" name="kernel-rt-modules-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.24.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.16.1.el9_8]" date="1781611200">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308]
- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048]
- gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056}
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699]
- mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175820]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.24.1" date="1783598400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="e7b6bb2df7295fcccfce9b46936c65bcc7ea04088f565230a235e8535697a073" name="kernel-rt-modules-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.25.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.25.1" date="1783944000">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="91ff4f6e7955e25a32888c07504fa9843ada45d63527defcfd2d443bceb47548" name="kernel-rt-modules-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.26.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.26.1.el9_8]" date="1783944000">- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.26.1" date="1784030400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="51e26b509d935b07ca6b13e683f80daa067be94ed3898517f1d988b16779f462" name="kernel-rt-modules-core" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.29.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [5.14.0-687.26.1.el9_8]" date="1784030400">- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.27.1.el9_8]" date="1784203200">- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886]
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113}
- crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943]
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110}
- net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121]
- net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121]
- net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121]
- net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121]
- net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121]
- net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121]
- net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121]
- net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121]
- net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121]
- net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121]
- net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix deadlock between devlink lock and esw-&gt;wq (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121]
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121]
- net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121]
- net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121]
- net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121]
- IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121]
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071}
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980]
- libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.28.1.el9_8]" date="1784548800">- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.29.1.el9_8]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685]
- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061]
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099}
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.29.1" date="1784721600">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="d20c4e1fc3deaf7ad35c586951f6348ee95efb3c10ee09dca94ec1bdb0f38fa6" name="kernel-rt-modules-extra" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.10.1.el9_8.0.1"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.3.1.el9_8]" date="1774008000">- HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818}
- NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415]
- perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340]
- perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340]
- perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340]
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193}
- nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552]
- redhat: genlog: add new JIRA cloud server hostname (Jan Stancek)
- gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055]
- io_uring: graduate to full support (Jeff Moyer) [RHEL-120699]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231}
- net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180}
- net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424]
- macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227]
- macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209}
- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814]
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814]
- migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097}
- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.4.1.el9_8]" date="1774612800">- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144}
- ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365]
- libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611]
- libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611]
- libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611]
- libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611]
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611]
- libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611]
- redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611]
- redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611]
- crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611]
- ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210}
- smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396]
- wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.5.1.el9_8]" date="1775044800">- kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672]
- kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672]
- RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243}
- net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109}
- iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.6.1.el9_8]" date="1776340800">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402}
- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741}
- smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988]
- ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378]
- RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966]
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207]
- ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095]
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.10.1" date="1779278400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@resf.org&gt; - 5.14.0-687.10.1.0.1" date="1779537600">- Bump release for rebuild with updated rocky-sb-certs</changelog>
</package>
<package pkgid="56101d369cde6df920674fe746540caf7c5e8ee84ee398d2dac3684e253330c2" name="kernel-rt-modules-extra" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.12.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.4.1.el9_8]" date="1774612800">- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144}
- ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365]
- libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611]
- libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611]
- libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611]
- libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611]
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611]
- libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611]
- redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611]
- redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611]
- crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611]
- ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210}
- smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396]
- wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.5.1.el9_8]" date="1775044800">- kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672]
- kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672]
- RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243}
- net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109}
- iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.6.1.el9_8]" date="1776340800">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402}
- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741}
- smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988]
- ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378]
- RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966]
- RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966]
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207]
- ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095]
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.11.1.el9_8]" date="1779192000">- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
- ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
- ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
- ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
- ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
- ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
- ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
- nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
- x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
- ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
- ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
- Revert "mm: pcp: increase pcp-&gt;free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.12.1.el9_8]" date="1779710400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.12.1" date="1779969600">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="9ebf1b3f85c618419114d6a2dfba827084466e30ba6d240a9154cb9231c84fc7" name="kernel-rt-modules-extra" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.15.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.7.1.el9_8]" date="1777032000">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.8.1.el9_8]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [5.14.0-687.9.1.el9_8]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.10.1.el9_8]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.11.1.el9_8]" date="1779192000">- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
- redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
- ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
- ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
- ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
- ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
- ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
- ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
- nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
- x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
- ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
- ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
- Revert "mm: pcp: increase pcp-&gt;free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.12.1.el9_8]" date="1779710400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.13.1.el9_8]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243}
- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472]
- nvme: nvme-fc: Ensure -&gt;ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786}
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167]
- crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613}
- mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778]
- mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778]
- mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778]
- mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778]
- mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778]
- mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778]
- mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778]</changelog>
  <changelog author="Tanishi Srivastava &lt;tsrivast@redhat.com&gt; [5.14.0-687.14.1.el9_8]" date="1781006400">- RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181}
- redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501}
- RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852}
- netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116}
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526]
- ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336]
- ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336]
- ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336]
- dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938]
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056}
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216}
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419}
- x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.15.1.el9_8]" date="1781092800">- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037}
- net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.15.1" date="1781179200">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="b1affbf056a8d1ffaae5ae1b2bb675b065f2400342cb816a087cc18dc4c79145" name="kernel-rt-modules-extra" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.24.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.16.1.el9_8]" date="1781611200">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308]
- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048]
- gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056}
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699]
- mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175820]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.24.1" date="1783598400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="5d93ea89906bf000f1c5759ca99b26be1e6a70843be13546a52e6be2f711e1e3" name="kernel-rt-modules-extra" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.25.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.17.1.el9_8]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.25.1" date="1783944000">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="ebd2b2e17f021d59037d94ab9ea3396eedca0c5bc6ce57b145432c9cbc06552c" name="kernel-rt-modules-extra" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.26.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.18.1.el9_8]" date="1782216000">- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
- net: Fix typos (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistake "disabliing" -&gt; "disabling" (Kamal Heib) [RHEL-169057]
- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.19.1.el9_8]" date="1782388800">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.20.1.el9_8]" date="1782734400">- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.26.1.el9_8]" date="1783944000">- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.26.1" date="1784030400">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="c664bd86233d841c7b9c46962a95a9daa33f0caba0ddcb63c251a70ae2c756d3" name="kernel-rt-modules-extra" arch="aarch64">
  <version epoch="0" ver="5.14.0" rel="687.29.1.el9_8"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.21.1.el9_8]" date="1782993600">- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.22.1.el9_8]" date="1783339200">- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.23.1.el9_8]" date="1783339201">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.24.1.el9_8]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.25.1.el9_8]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}</changelog>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [5.14.0-687.26.1.el9_8]" date="1784030400">- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.27.1.el9_8]" date="1784203200">- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886]
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113}
- crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943]
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110}
- net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121]
- net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121]
- net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121]
- net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121]
- net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121]
- net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121]
- net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121]
- net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121]
- net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121]
- net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121]
- net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix deadlock between devlink lock and esw-&gt;wq (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121]
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121]
- net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121]
- net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121]
- net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121]
- IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121]
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071}
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980]
- libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.28.1.el9_8]" date="1784548800">- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [5.14.0-687.29.1.el9_8]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685]
- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061]
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099}
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 5.14.0-687.29.1" date="1784721600">- Replace sbat with Rocky Linux sbat (label)
- Change bug tracker URL (label)
- Ensure appended release in sbat is removed</changelog>
</package>
<package pkgid="e0d42dbd06225081f775181659523eeed2e25e15ed96f7dc659cb296145d1c8f" name="realtime-setup" arch="aarch64">
  <version epoch="0" ver="2.5" rel="4.el9"/>
  <changelog author="Clark Williams &lt;williams@redhat.com&gt; - 2.5-1" date="1723550400">- remove strip of realtime-entsk and generate debuginfo
- ensure all files have valid SPDX license identifiers
- remove Red Hat Makefile targets and specfile
- Makefile cleanups and added .gitignore
- drop the 'v' in the version string for the tarball
- Makefile: add options for passing annocheck
- Bump version to 2.5
Resolves: RHEL-30179</changelog>
  <changelog author="John Kacur &lt;jkacur@redhat.com&gt; - 2.5-2" date="1733745600">- Add an rpminspect.yaml file to turn-off debuginfo testing
Resolves: RHEL-70582</changelog>
  <changelog author="John Kacur &lt;jkacur@redhat.com&gt; - 2.5-3" date="1733832000">- Rebuild
Resolves: RHEL-70582</changelog>
  <changelog author="John Kacur &lt;jkacur@redhat.com&gt; - 2.5-4" date="1737547200">- Do not generate debug packages
Resolves: RHEL-70582</changelog>
</package>
<package pkgid="f41aff50a4403428e0ffc9b0f1f45630da04068ff986f3c5dcfe677076b1123c" name="rteval" arch="noarch">
  <version epoch="0" ver="3.10" rel="1.el9"/>
  <changelog author="Crystal Wood &lt;crwood@redhat.com&gt; - 3.8-5" date="1722254400">- Prevent using cyclictest and timerlat and the same time
- Add a --noload option
- Switch to autosetup, picking up the updates that should have been in 3.8-4
Resolves: RHEL-35506
Resolves: RHEL-50323</changelog>
  <changelog author="Anubhav Shelat &lt;ashelat@redhat.com&gt; - 3.8-6" date="1722945600">- Add functionality to allow user to execute cpupower tool to
set idle state depth  while running rteval.
- Disable latency trick by using --default-system option with
cyclictest when setting idle state depth.
Resolves: RHEL-37645</changelog>
  <changelog author="Tomas Glozar &lt;tglozar@redhat.com&gt; - 3.8-7" date="1723464000">- Collect tuned state in sysinfo
Resolves: RHEL-33303</changelog>
  <changelog author="John Kacur &lt;jkacur@redhat.com&gt; - 3.8-8" date="1729857600">- Update the kcompile kernel to linux-6.12-rc4
Resolves: RHEL-63621</changelog>
  <changelog author="John Kacur &lt;jkacur@redhat.com&gt; - 3.9-1" date="1731585600">- Rebase to upstream rteval-v3.9
Resolves: RHEL-63519</changelog>
  <changelog author="John Kacur &lt;jkacur@redhat.com&gt; - 3.9-2" date="1734091200">- Fix missing system statistics
Resolves: RHEL-70166</changelog>
  <changelog author="John Kacur &lt;jkacur@redhat.com&gt; - 3.9-3" date="1738929600">- Make the default interval for timerlat in rteval 1100us
- Make cyclictest the default measurement module for rteval
Resolves: RHEL-78394</changelog>
  <changelog author="John Kacur &lt;jkacur@redhat.com&gt; - 3.9-4" date="1750248000">- Fix syntax warning when using python &gt;=3.12
Resolves: RHEL-97825</changelog>
  <changelog author="John Kacur &lt;jkacur@redhat.com&gt; - 3.9-5" date="1750334400">- Make timerlat the default measurement module
- Make the default interval 100us
Resolves: RHEL-97540</changelog>
  <changelog author="John Kacur &lt;jkacur@redhat.com&gt; - 3.10-1" date="1763553600">- Rebase to upstream rteval-3.10
Resolves: RHEL-82914, RHEL-111000, RHEL-114928</changelog>
</package>
<package pkgid="22d54c501f0673c3440b846aa7494dc3c84e5da89a41b42efe1ccbeca5583c1e" name="rteval-loads" arch="noarch">
  <version epoch="0" ver="6.17.7" rel="2.el9"/>
  <changelog author="John Kacur &lt;jkacur@redhat.com&gt; - 1.6-5" date="1729857600">- Upgrade the kernel to linux-6.12-rc4
Resolves: RHEL-63614</changelog>
  <changelog author="John Kacur &lt;jkacur@redhat.com&gt; - 1.6-6" date="1731672000">- Rebuild to go through gating
Resolves: RHEL-67848</changelog>
  <changelog author="John Kacur &lt;jkacur@redhat.com&gt; - 6.17.7-1" date="1763121600">- Changed the kernel version to 6.17.7
- changed the rteval-loads number scheme to reflect the kernel version
Resolves: RHEL-86701</changelog>
  <changelog author="John Kacur &lt;jkacur@redhat.com&gt; - 6.17.7-2" date="1763553600">- Rebuid in a side tag in order to sync with rteval
Resolves: RHEL-86701</changelog>
</package>
<package pkgid="733f9469bc302dd9cf9a2e18dbd6eeafcdaa124376722d3739a6af194eb0d165" name="tuned-profiles-nfv" arch="noarch">
  <version epoch="0" ver="2.27.0" rel="1.el9"/>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.24.0-1" date="1723032000">- new release
  - rebased tuned to latest upstream
    related: RHEL-50568
  - clear plugin repository when stopping tuning
  - man: add description of the balanced-battery profile</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.24.0-2" date="1731931200">- Fixed privileged execution of arbitrary scripts by active local user,
  (CVE-2024-52336)
  Resolves: RHEL-66638
- Added sanity checks for API methods parameters, (CVE-2024-52337)
  Resolves: RHEL-66615</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.25.0-0.1.rc1" date="1737288000">- new release
  - rebased tuned to latest upstream
    resolves: RHEL-70457
  - tuned-ppd: removed the use of StrEnum
  - tuned-ppd: fixed traceback
  - tuned-ppd: multiple fixes and updates
  - docs: plugins docs are now automatically generated from the docstrings
  - plugin_cpu: fixed no_turbo boolean option parsing
    resolves: RHEL-51760
  - plugin_cpu: allowed raw energy_performance_preference values
  - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters
    resolves: RHEL-58820
  - plugin_bootloader: added variables to BLS entries only if grub is used
  - plugin_scheduler: do not assume that perf events have type attribute
  - plugin_scheduler: updated sched knobs for kernels 6.6+
  - plugin_scheduler: log process info when its affinity cannot be changed
  - plugin_scheduler: postpone cgroup blacklist check, double-check after fail
    resolves: RHEL-72981
  - plugin_scheduler: made perf support optional
  - plugin_net: added support for hotplug and rename
    resolves: RHEL-60906
  - makefile: added support for installation to custom $BINDIR/$SBINDIR
  - functions: dropped cpuspeed support</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.25.0-1" date="1738324800">- new release
  - rebased tuned to latest upstream
    related: RHEL-70457
  - sap-hana: Set transparent_hugepages to madvise
  - plugin_bootloader: export Grub variables to make them available in submenus
  - utils.commands: fixed CPU online detection when not present
  - plugin_net: handled cqe-mode-rx ethtool option
  - profiles: correct CPU governor settings</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.25.1-1" date="1738670400">- new release
  - rebased tuned to latest upstream
    related: RHEL-70457
  - plugins: added missing instance parameters
  - disk: added missing remove parameter
  - plugin_scheduler: added switch to disable processing of kthreads
  - Makefile: added support for installation to custom LIBEXECDIR
  - functions: create a new parser object for each string expansion
    resolves: RHEL-75773</changelog>
  <changelog author="Pavol &#x17D;&#xE1;&#x10D;ik &lt;pzacik@redhat.com&gt; - 2.25.1-2" date="1749124800">- Fix handling of kernel arguments on bootc systems
  resolves: RHEL-45836
  resolves: RHEL-86814</changelog>
  <changelog author="Jaroslav &#x160;karvada  &lt;jskarvad@redhat.com&gt; - 2.26.0-0.1.rc1" date="1755432000">- new release
  - rebased tuned to latest upstream
    resolves: RHEL-94808
  - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor
  - tuned-ppd: enabled sysfs_acpi_monitor by default
  - tuned-ppd: fixed inotify watch for performance degradation
  - tuned-ppd: pinned virtual files in memory for inotify
  - fixed instance priority inheritance
  - hotplug: added fixes for device remove race condition
  - tuned-main.conf: added startup_udev_settle_wait option
  - functions: silenced errors if module kvm_intel does not exist
    resolves: RHEL-79943
  - functions: make calc_isolated_cores return CPU ranges
    resolves: RHEL-75751
  - scsi: used 'med_power_with_dipm' for SATA ALPM
  - scsi: do not set ALPM on external SATA ports
  - network_latency: Set non-zero rcutree.nohz_full_patience_delay
  - realtime: Disable appropriate P-State drivers
    resolves: RHEL-85637
  - plugin_disk: added support for MMC (MultiMediaCard) devices
  - udev: fix possible traceback in device matcher
  - udev-settle: obey udev buffer size and handle possible tracebacks
  - daemon: re-raise daemon init exception in no-daemon mode
    resolves: RHEL-71304
  - vm: deprecate dirty_ratio in favour of dirty_bytes with percents
    resolves: RHEL-101578
  - gui: fix the profile deleter script</changelog>
  <changelog author="Jaroslav &#x160;karvada  &lt;jskarvad@redhat.com&gt; - 2.26.0-1" date="1756123200">- new release
  - rebased tuned to latest upstream
    related: RHEL-94808</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.27.0-0.1.rc1" date="1770724800">- new release
  - rebased tuned to latest upstream
    resolves: RHEL-123607
  - cpu-partitioning: autodetect dracut hook directory, systemd workaround
  - openshift: optimize TCP settings for high throughput and low latency
  - profiles: Set boost=1 in *-performance profiles
  - sap-hana: force latency to 70 us, not to C-states
  - man: fixed instance_acquire_devices example in tuned-adm man
  - spec: use correct python interpreter for documentation installation
  - sysctl: add reapply_sysctl_exclude option
  - ppd: ask tuned recommend for base profile</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.27.0-1" date="1771761600">- new release
  - rebased tuned to latest upstream
    related: RHEL-123607</changelog>
</package>
<package pkgid="b6221c5356bb03e8053aa7611f4d9fa55aa2bbdb3ed0a78e286a3c536eed59fc" name="tuned-profiles-nfv" arch="noarch">
  <version epoch="0" ver="2.27.0" rel="2.el9_8"/>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.24.0-2" date="1731931200">- Fixed privileged execution of arbitrary scripts by active local user,
  (CVE-2024-52336)
  Resolves: RHEL-66638
- Added sanity checks for API methods parameters, (CVE-2024-52337)
  Resolves: RHEL-66615</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.25.0-0.1.rc1" date="1737288000">- new release
  - rebased tuned to latest upstream
    resolves: RHEL-70457
  - tuned-ppd: removed the use of StrEnum
  - tuned-ppd: fixed traceback
  - tuned-ppd: multiple fixes and updates
  - docs: plugins docs are now automatically generated from the docstrings
  - plugin_cpu: fixed no_turbo boolean option parsing
    resolves: RHEL-51760
  - plugin_cpu: allowed raw energy_performance_preference values
  - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters
    resolves: RHEL-58820
  - plugin_bootloader: added variables to BLS entries only if grub is used
  - plugin_scheduler: do not assume that perf events have type attribute
  - plugin_scheduler: updated sched knobs for kernels 6.6+
  - plugin_scheduler: log process info when its affinity cannot be changed
  - plugin_scheduler: postpone cgroup blacklist check, double-check after fail
    resolves: RHEL-72981
  - plugin_scheduler: made perf support optional
  - plugin_net: added support for hotplug and rename
    resolves: RHEL-60906
  - makefile: added support for installation to custom $BINDIR/$SBINDIR
  - functions: dropped cpuspeed support</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.25.0-1" date="1738324800">- new release
  - rebased tuned to latest upstream
    related: RHEL-70457
  - sap-hana: Set transparent_hugepages to madvise
  - plugin_bootloader: export Grub variables to make them available in submenus
  - utils.commands: fixed CPU online detection when not present
  - plugin_net: handled cqe-mode-rx ethtool option
  - profiles: correct CPU governor settings</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.25.1-1" date="1738670400">- new release
  - rebased tuned to latest upstream
    related: RHEL-70457
  - plugins: added missing instance parameters
  - disk: added missing remove parameter
  - plugin_scheduler: added switch to disable processing of kthreads
  - Makefile: added support for installation to custom LIBEXECDIR
  - functions: create a new parser object for each string expansion
    resolves: RHEL-75773</changelog>
  <changelog author="Pavol &#x17D;&#xE1;&#x10D;ik &lt;pzacik@redhat.com&gt; - 2.25.1-2" date="1749124800">- Fix handling of kernel arguments on bootc systems
  resolves: RHEL-45836
  resolves: RHEL-86814</changelog>
  <changelog author="Jaroslav &#x160;karvada  &lt;jskarvad@redhat.com&gt; - 2.26.0-0.1.rc1" date="1755432000">- new release
  - rebased tuned to latest upstream
    resolves: RHEL-94808
  - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor
  - tuned-ppd: enabled sysfs_acpi_monitor by default
  - tuned-ppd: fixed inotify watch for performance degradation
  - tuned-ppd: pinned virtual files in memory for inotify
  - fixed instance priority inheritance
  - hotplug: added fixes for device remove race condition
  - tuned-main.conf: added startup_udev_settle_wait option
  - functions: silenced errors if module kvm_intel does not exist
    resolves: RHEL-79943
  - functions: make calc_isolated_cores return CPU ranges
    resolves: RHEL-75751
  - scsi: used 'med_power_with_dipm' for SATA ALPM
  - scsi: do not set ALPM on external SATA ports
  - network_latency: Set non-zero rcutree.nohz_full_patience_delay
  - realtime: Disable appropriate P-State drivers
    resolves: RHEL-85637
  - plugin_disk: added support for MMC (MultiMediaCard) devices
  - udev: fix possible traceback in device matcher
  - udev-settle: obey udev buffer size and handle possible tracebacks
  - daemon: re-raise daemon init exception in no-daemon mode
    resolves: RHEL-71304
  - vm: deprecate dirty_ratio in favour of dirty_bytes with percents
    resolves: RHEL-101578
  - gui: fix the profile deleter script</changelog>
  <changelog author="Jaroslav &#x160;karvada  &lt;jskarvad@redhat.com&gt; - 2.26.0-1" date="1756123200">- new release
  - rebased tuned to latest upstream
    related: RHEL-94808</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.27.0-0.1.rc1" date="1770724800">- new release
  - rebased tuned to latest upstream
    resolves: RHEL-123607
  - cpu-partitioning: autodetect dracut hook directory, systemd workaround
  - openshift: optimize TCP settings for high throughput and low latency
  - profiles: Set boost=1 in *-performance profiles
  - sap-hana: force latency to 70 us, not to C-states
  - man: fixed instance_acquire_devices example in tuned-adm man
  - spec: use correct python interpreter for documentation installation
  - sysctl: add reapply_sysctl_exclude option
  - ppd: ask tuned recommend for base profile</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.27.0-1" date="1771761600">- new release
  - rebased tuned to latest upstream
    related: RHEL-123607</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.27.0-2" date="1781524800">- net: added more coalescing options, filter out unsupported ones
  resolves: RHEL-181668</changelog>
</package>
<package pkgid="41045aabe1e17751d389610aa6a0a410fc80c959b292212ee9654651c4a98b92" name="tuned-profiles-nfv-guest" arch="noarch">
  <version epoch="0" ver="2.27.0" rel="1.el9"/>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.24.0-1" date="1723032000">- new release
  - rebased tuned to latest upstream
    related: RHEL-50568
  - clear plugin repository when stopping tuning
  - man: add description of the balanced-battery profile</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.24.0-2" date="1731931200">- Fixed privileged execution of arbitrary scripts by active local user,
  (CVE-2024-52336)
  Resolves: RHEL-66638
- Added sanity checks for API methods parameters, (CVE-2024-52337)
  Resolves: RHEL-66615</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.25.0-0.1.rc1" date="1737288000">- new release
  - rebased tuned to latest upstream
    resolves: RHEL-70457
  - tuned-ppd: removed the use of StrEnum
  - tuned-ppd: fixed traceback
  - tuned-ppd: multiple fixes and updates
  - docs: plugins docs are now automatically generated from the docstrings
  - plugin_cpu: fixed no_turbo boolean option parsing
    resolves: RHEL-51760
  - plugin_cpu: allowed raw energy_performance_preference values
  - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters
    resolves: RHEL-58820
  - plugin_bootloader: added variables to BLS entries only if grub is used
  - plugin_scheduler: do not assume that perf events have type attribute
  - plugin_scheduler: updated sched knobs for kernels 6.6+
  - plugin_scheduler: log process info when its affinity cannot be changed
  - plugin_scheduler: postpone cgroup blacklist check, double-check after fail
    resolves: RHEL-72981
  - plugin_scheduler: made perf support optional
  - plugin_net: added support for hotplug and rename
    resolves: RHEL-60906
  - makefile: added support for installation to custom $BINDIR/$SBINDIR
  - functions: dropped cpuspeed support</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.25.0-1" date="1738324800">- new release
  - rebased tuned to latest upstream
    related: RHEL-70457
  - sap-hana: Set transparent_hugepages to madvise
  - plugin_bootloader: export Grub variables to make them available in submenus
  - utils.commands: fixed CPU online detection when not present
  - plugin_net: handled cqe-mode-rx ethtool option
  - profiles: correct CPU governor settings</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.25.1-1" date="1738670400">- new release
  - rebased tuned to latest upstream
    related: RHEL-70457
  - plugins: added missing instance parameters
  - disk: added missing remove parameter
  - plugin_scheduler: added switch to disable processing of kthreads
  - Makefile: added support for installation to custom LIBEXECDIR
  - functions: create a new parser object for each string expansion
    resolves: RHEL-75773</changelog>
  <changelog author="Pavol &#x17D;&#xE1;&#x10D;ik &lt;pzacik@redhat.com&gt; - 2.25.1-2" date="1749124800">- Fix handling of kernel arguments on bootc systems
  resolves: RHEL-45836
  resolves: RHEL-86814</changelog>
  <changelog author="Jaroslav &#x160;karvada  &lt;jskarvad@redhat.com&gt; - 2.26.0-0.1.rc1" date="1755432000">- new release
  - rebased tuned to latest upstream
    resolves: RHEL-94808
  - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor
  - tuned-ppd: enabled sysfs_acpi_monitor by default
  - tuned-ppd: fixed inotify watch for performance degradation
  - tuned-ppd: pinned virtual files in memory for inotify
  - fixed instance priority inheritance
  - hotplug: added fixes for device remove race condition
  - tuned-main.conf: added startup_udev_settle_wait option
  - functions: silenced errors if module kvm_intel does not exist
    resolves: RHEL-79943
  - functions: make calc_isolated_cores return CPU ranges
    resolves: RHEL-75751
  - scsi: used 'med_power_with_dipm' for SATA ALPM
  - scsi: do not set ALPM on external SATA ports
  - network_latency: Set non-zero rcutree.nohz_full_patience_delay
  - realtime: Disable appropriate P-State drivers
    resolves: RHEL-85637
  - plugin_disk: added support for MMC (MultiMediaCard) devices
  - udev: fix possible traceback in device matcher
  - udev-settle: obey udev buffer size and handle possible tracebacks
  - daemon: re-raise daemon init exception in no-daemon mode
    resolves: RHEL-71304
  - vm: deprecate dirty_ratio in favour of dirty_bytes with percents
    resolves: RHEL-101578
  - gui: fix the profile deleter script</changelog>
  <changelog author="Jaroslav &#x160;karvada  &lt;jskarvad@redhat.com&gt; - 2.26.0-1" date="1756123200">- new release
  - rebased tuned to latest upstream
    related: RHEL-94808</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.27.0-0.1.rc1" date="1770724800">- new release
  - rebased tuned to latest upstream
    resolves: RHEL-123607
  - cpu-partitioning: autodetect dracut hook directory, systemd workaround
  - openshift: optimize TCP settings for high throughput and low latency
  - profiles: Set boost=1 in *-performance profiles
  - sap-hana: force latency to 70 us, not to C-states
  - man: fixed instance_acquire_devices example in tuned-adm man
  - spec: use correct python interpreter for documentation installation
  - sysctl: add reapply_sysctl_exclude option
  - ppd: ask tuned recommend for base profile</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.27.0-1" date="1771761600">- new release
  - rebased tuned to latest upstream
    related: RHEL-123607</changelog>
</package>
<package pkgid="102a2372344284608a8e2954478abe2f561dfdf06cbc9c8358ad35fcf15b5d9c" name="tuned-profiles-nfv-guest" arch="noarch">
  <version epoch="0" ver="2.27.0" rel="2.el9_8"/>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.24.0-2" date="1731931200">- Fixed privileged execution of arbitrary scripts by active local user,
  (CVE-2024-52336)
  Resolves: RHEL-66638
- Added sanity checks for API methods parameters, (CVE-2024-52337)
  Resolves: RHEL-66615</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.25.0-0.1.rc1" date="1737288000">- new release
  - rebased tuned to latest upstream
    resolves: RHEL-70457
  - tuned-ppd: removed the use of StrEnum
  - tuned-ppd: fixed traceback
  - tuned-ppd: multiple fixes and updates
  - docs: plugins docs are now automatically generated from the docstrings
  - plugin_cpu: fixed no_turbo boolean option parsing
    resolves: RHEL-51760
  - plugin_cpu: allowed raw energy_performance_preference values
  - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters
    resolves: RHEL-58820
  - plugin_bootloader: added variables to BLS entries only if grub is used
  - plugin_scheduler: do not assume that perf events have type attribute
  - plugin_scheduler: updated sched knobs for kernels 6.6+
  - plugin_scheduler: log process info when its affinity cannot be changed
  - plugin_scheduler: postpone cgroup blacklist check, double-check after fail
    resolves: RHEL-72981
  - plugin_scheduler: made perf support optional
  - plugin_net: added support for hotplug and rename
    resolves: RHEL-60906
  - makefile: added support for installation to custom $BINDIR/$SBINDIR
  - functions: dropped cpuspeed support</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.25.0-1" date="1738324800">- new release
  - rebased tuned to latest upstream
    related: RHEL-70457
  - sap-hana: Set transparent_hugepages to madvise
  - plugin_bootloader: export Grub variables to make them available in submenus
  - utils.commands: fixed CPU online detection when not present
  - plugin_net: handled cqe-mode-rx ethtool option
  - profiles: correct CPU governor settings</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.25.1-1" date="1738670400">- new release
  - rebased tuned to latest upstream
    related: RHEL-70457
  - plugins: added missing instance parameters
  - disk: added missing remove parameter
  - plugin_scheduler: added switch to disable processing of kthreads
  - Makefile: added support for installation to custom LIBEXECDIR
  - functions: create a new parser object for each string expansion
    resolves: RHEL-75773</changelog>
  <changelog author="Pavol &#x17D;&#xE1;&#x10D;ik &lt;pzacik@redhat.com&gt; - 2.25.1-2" date="1749124800">- Fix handling of kernel arguments on bootc systems
  resolves: RHEL-45836
  resolves: RHEL-86814</changelog>
  <changelog author="Jaroslav &#x160;karvada  &lt;jskarvad@redhat.com&gt; - 2.26.0-0.1.rc1" date="1755432000">- new release
  - rebased tuned to latest upstream
    resolves: RHEL-94808
  - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor
  - tuned-ppd: enabled sysfs_acpi_monitor by default
  - tuned-ppd: fixed inotify watch for performance degradation
  - tuned-ppd: pinned virtual files in memory for inotify
  - fixed instance priority inheritance
  - hotplug: added fixes for device remove race condition
  - tuned-main.conf: added startup_udev_settle_wait option
  - functions: silenced errors if module kvm_intel does not exist
    resolves: RHEL-79943
  - functions: make calc_isolated_cores return CPU ranges
    resolves: RHEL-75751
  - scsi: used 'med_power_with_dipm' for SATA ALPM
  - scsi: do not set ALPM on external SATA ports
  - network_latency: Set non-zero rcutree.nohz_full_patience_delay
  - realtime: Disable appropriate P-State drivers
    resolves: RHEL-85637
  - plugin_disk: added support for MMC (MultiMediaCard) devices
  - udev: fix possible traceback in device matcher
  - udev-settle: obey udev buffer size and handle possible tracebacks
  - daemon: re-raise daemon init exception in no-daemon mode
    resolves: RHEL-71304
  - vm: deprecate dirty_ratio in favour of dirty_bytes with percents
    resolves: RHEL-101578
  - gui: fix the profile deleter script</changelog>
  <changelog author="Jaroslav &#x160;karvada  &lt;jskarvad@redhat.com&gt; - 2.26.0-1" date="1756123200">- new release
  - rebased tuned to latest upstream
    related: RHEL-94808</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.27.0-0.1.rc1" date="1770724800">- new release
  - rebased tuned to latest upstream
    resolves: RHEL-123607
  - cpu-partitioning: autodetect dracut hook directory, systemd workaround
  - openshift: optimize TCP settings for high throughput and low latency
  - profiles: Set boost=1 in *-performance profiles
  - sap-hana: force latency to 70 us, not to C-states
  - man: fixed instance_acquire_devices example in tuned-adm man
  - spec: use correct python interpreter for documentation installation
  - sysctl: add reapply_sysctl_exclude option
  - ppd: ask tuned recommend for base profile</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.27.0-1" date="1771761600">- new release
  - rebased tuned to latest upstream
    related: RHEL-123607</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.27.0-2" date="1781524800">- net: added more coalescing options, filter out unsupported ones
  resolves: RHEL-181668</changelog>
</package>
<package pkgid="2203b7889f159c6816fea96e2099b7501ca0cfcf1f3fba99ebd433b5e353526d" name="tuned-profiles-nfv-host" arch="noarch">
  <version epoch="0" ver="2.27.0" rel="1.el9"/>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.24.0-1" date="1723032000">- new release
  - rebased tuned to latest upstream
    related: RHEL-50568
  - clear plugin repository when stopping tuning
  - man: add description of the balanced-battery profile</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.24.0-2" date="1731931200">- Fixed privileged execution of arbitrary scripts by active local user,
  (CVE-2024-52336)
  Resolves: RHEL-66638
- Added sanity checks for API methods parameters, (CVE-2024-52337)
  Resolves: RHEL-66615</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.25.0-0.1.rc1" date="1737288000">- new release
  - rebased tuned to latest upstream
    resolves: RHEL-70457
  - tuned-ppd: removed the use of StrEnum
  - tuned-ppd: fixed traceback
  - tuned-ppd: multiple fixes and updates
  - docs: plugins docs are now automatically generated from the docstrings
  - plugin_cpu: fixed no_turbo boolean option parsing
    resolves: RHEL-51760
  - plugin_cpu: allowed raw energy_performance_preference values
  - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters
    resolves: RHEL-58820
  - plugin_bootloader: added variables to BLS entries only if grub is used
  - plugin_scheduler: do not assume that perf events have type attribute
  - plugin_scheduler: updated sched knobs for kernels 6.6+
  - plugin_scheduler: log process info when its affinity cannot be changed
  - plugin_scheduler: postpone cgroup blacklist check, double-check after fail
    resolves: RHEL-72981
  - plugin_scheduler: made perf support optional
  - plugin_net: added support for hotplug and rename
    resolves: RHEL-60906
  - makefile: added support for installation to custom $BINDIR/$SBINDIR
  - functions: dropped cpuspeed support</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.25.0-1" date="1738324800">- new release
  - rebased tuned to latest upstream
    related: RHEL-70457
  - sap-hana: Set transparent_hugepages to madvise
  - plugin_bootloader: export Grub variables to make them available in submenus
  - utils.commands: fixed CPU online detection when not present
  - plugin_net: handled cqe-mode-rx ethtool option
  - profiles: correct CPU governor settings</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.25.1-1" date="1738670400">- new release
  - rebased tuned to latest upstream
    related: RHEL-70457
  - plugins: added missing instance parameters
  - disk: added missing remove parameter
  - plugin_scheduler: added switch to disable processing of kthreads
  - Makefile: added support for installation to custom LIBEXECDIR
  - functions: create a new parser object for each string expansion
    resolves: RHEL-75773</changelog>
  <changelog author="Pavol &#x17D;&#xE1;&#x10D;ik &lt;pzacik@redhat.com&gt; - 2.25.1-2" date="1749124800">- Fix handling of kernel arguments on bootc systems
  resolves: RHEL-45836
  resolves: RHEL-86814</changelog>
  <changelog author="Jaroslav &#x160;karvada  &lt;jskarvad@redhat.com&gt; - 2.26.0-0.1.rc1" date="1755432000">- new release
  - rebased tuned to latest upstream
    resolves: RHEL-94808
  - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor
  - tuned-ppd: enabled sysfs_acpi_monitor by default
  - tuned-ppd: fixed inotify watch for performance degradation
  - tuned-ppd: pinned virtual files in memory for inotify
  - fixed instance priority inheritance
  - hotplug: added fixes for device remove race condition
  - tuned-main.conf: added startup_udev_settle_wait option
  - functions: silenced errors if module kvm_intel does not exist
    resolves: RHEL-79943
  - functions: make calc_isolated_cores return CPU ranges
    resolves: RHEL-75751
  - scsi: used 'med_power_with_dipm' for SATA ALPM
  - scsi: do not set ALPM on external SATA ports
  - network_latency: Set non-zero rcutree.nohz_full_patience_delay
  - realtime: Disable appropriate P-State drivers
    resolves: RHEL-85637
  - plugin_disk: added support for MMC (MultiMediaCard) devices
  - udev: fix possible traceback in device matcher
  - udev-settle: obey udev buffer size and handle possible tracebacks
  - daemon: re-raise daemon init exception in no-daemon mode
    resolves: RHEL-71304
  - vm: deprecate dirty_ratio in favour of dirty_bytes with percents
    resolves: RHEL-101578
  - gui: fix the profile deleter script</changelog>
  <changelog author="Jaroslav &#x160;karvada  &lt;jskarvad@redhat.com&gt; - 2.26.0-1" date="1756123200">- new release
  - rebased tuned to latest upstream
    related: RHEL-94808</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.27.0-0.1.rc1" date="1770724800">- new release
  - rebased tuned to latest upstream
    resolves: RHEL-123607
  - cpu-partitioning: autodetect dracut hook directory, systemd workaround
  - openshift: optimize TCP settings for high throughput and low latency
  - profiles: Set boost=1 in *-performance profiles
  - sap-hana: force latency to 70 us, not to C-states
  - man: fixed instance_acquire_devices example in tuned-adm man
  - spec: use correct python interpreter for documentation installation
  - sysctl: add reapply_sysctl_exclude option
  - ppd: ask tuned recommend for base profile</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.27.0-1" date="1771761600">- new release
  - rebased tuned to latest upstream
    related: RHEL-123607</changelog>
</package>
<package pkgid="28ed6b4eb4b1c2a4110837f8ce68d642d8b794843c9900e4f76d8f8b4ce84979" name="tuned-profiles-nfv-host" arch="noarch">
  <version epoch="0" ver="2.27.0" rel="2.el9_8"/>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.24.0-2" date="1731931200">- Fixed privileged execution of arbitrary scripts by active local user,
  (CVE-2024-52336)
  Resolves: RHEL-66638
- Added sanity checks for API methods parameters, (CVE-2024-52337)
  Resolves: RHEL-66615</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.25.0-0.1.rc1" date="1737288000">- new release
  - rebased tuned to latest upstream
    resolves: RHEL-70457
  - tuned-ppd: removed the use of StrEnum
  - tuned-ppd: fixed traceback
  - tuned-ppd: multiple fixes and updates
  - docs: plugins docs are now automatically generated from the docstrings
  - plugin_cpu: fixed no_turbo boolean option parsing
    resolves: RHEL-51760
  - plugin_cpu: allowed raw energy_performance_preference values
  - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters
    resolves: RHEL-58820
  - plugin_bootloader: added variables to BLS entries only if grub is used
  - plugin_scheduler: do not assume that perf events have type attribute
  - plugin_scheduler: updated sched knobs for kernels 6.6+
  - plugin_scheduler: log process info when its affinity cannot be changed
  - plugin_scheduler: postpone cgroup blacklist check, double-check after fail
    resolves: RHEL-72981
  - plugin_scheduler: made perf support optional
  - plugin_net: added support for hotplug and rename
    resolves: RHEL-60906
  - makefile: added support for installation to custom $BINDIR/$SBINDIR
  - functions: dropped cpuspeed support</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.25.0-1" date="1738324800">- new release
  - rebased tuned to latest upstream
    related: RHEL-70457
  - sap-hana: Set transparent_hugepages to madvise
  - plugin_bootloader: export Grub variables to make them available in submenus
  - utils.commands: fixed CPU online detection when not present
  - plugin_net: handled cqe-mode-rx ethtool option
  - profiles: correct CPU governor settings</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.25.1-1" date="1738670400">- new release
  - rebased tuned to latest upstream
    related: RHEL-70457
  - plugins: added missing instance parameters
  - disk: added missing remove parameter
  - plugin_scheduler: added switch to disable processing of kthreads
  - Makefile: added support for installation to custom LIBEXECDIR
  - functions: create a new parser object for each string expansion
    resolves: RHEL-75773</changelog>
  <changelog author="Pavol &#x17D;&#xE1;&#x10D;ik &lt;pzacik@redhat.com&gt; - 2.25.1-2" date="1749124800">- Fix handling of kernel arguments on bootc systems
  resolves: RHEL-45836
  resolves: RHEL-86814</changelog>
  <changelog author="Jaroslav &#x160;karvada  &lt;jskarvad@redhat.com&gt; - 2.26.0-0.1.rc1" date="1755432000">- new release
  - rebased tuned to latest upstream
    resolves: RHEL-94808
  - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor
  - tuned-ppd: enabled sysfs_acpi_monitor by default
  - tuned-ppd: fixed inotify watch for performance degradation
  - tuned-ppd: pinned virtual files in memory for inotify
  - fixed instance priority inheritance
  - hotplug: added fixes for device remove race condition
  - tuned-main.conf: added startup_udev_settle_wait option
  - functions: silenced errors if module kvm_intel does not exist
    resolves: RHEL-79943
  - functions: make calc_isolated_cores return CPU ranges
    resolves: RHEL-75751
  - scsi: used 'med_power_with_dipm' for SATA ALPM
  - scsi: do not set ALPM on external SATA ports
  - network_latency: Set non-zero rcutree.nohz_full_patience_delay
  - realtime: Disable appropriate P-State drivers
    resolves: RHEL-85637
  - plugin_disk: added support for MMC (MultiMediaCard) devices
  - udev: fix possible traceback in device matcher
  - udev-settle: obey udev buffer size and handle possible tracebacks
  - daemon: re-raise daemon init exception in no-daemon mode
    resolves: RHEL-71304
  - vm: deprecate dirty_ratio in favour of dirty_bytes with percents
    resolves: RHEL-101578
  - gui: fix the profile deleter script</changelog>
  <changelog author="Jaroslav &#x160;karvada  &lt;jskarvad@redhat.com&gt; - 2.26.0-1" date="1756123200">- new release
  - rebased tuned to latest upstream
    related: RHEL-94808</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.27.0-0.1.rc1" date="1770724800">- new release
  - rebased tuned to latest upstream
    resolves: RHEL-123607
  - cpu-partitioning: autodetect dracut hook directory, systemd workaround
  - openshift: optimize TCP settings for high throughput and low latency
  - profiles: Set boost=1 in *-performance profiles
  - sap-hana: force latency to 70 us, not to C-states
  - man: fixed instance_acquire_devices example in tuned-adm man
  - spec: use correct python interpreter for documentation installation
  - sysctl: add reapply_sysctl_exclude option
  - ppd: ask tuned recommend for base profile</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.27.0-1" date="1771761600">- new release
  - rebased tuned to latest upstream
    related: RHEL-123607</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.27.0-2" date="1781524800">- net: added more coalescing options, filter out unsupported ones
  resolves: RHEL-181668</changelog>
</package>
<package pkgid="2105983950e2b14a6b015ddda0bced97e3bfdc290fbde0e76af7f49889aac895" name="tuned-profiles-realtime" arch="noarch">
  <version epoch="0" ver="2.27.0" rel="1.el9"/>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.24.0-1" date="1723032000">- new release
  - rebased tuned to latest upstream
    related: RHEL-50568
  - clear plugin repository when stopping tuning
  - man: add description of the balanced-battery profile</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.24.0-2" date="1731931200">- Fixed privileged execution of arbitrary scripts by active local user,
  (CVE-2024-52336)
  Resolves: RHEL-66638
- Added sanity checks for API methods parameters, (CVE-2024-52337)
  Resolves: RHEL-66615</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.25.0-0.1.rc1" date="1737288000">- new release
  - rebased tuned to latest upstream
    resolves: RHEL-70457
  - tuned-ppd: removed the use of StrEnum
  - tuned-ppd: fixed traceback
  - tuned-ppd: multiple fixes and updates
  - docs: plugins docs are now automatically generated from the docstrings
  - plugin_cpu: fixed no_turbo boolean option parsing
    resolves: RHEL-51760
  - plugin_cpu: allowed raw energy_performance_preference values
  - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters
    resolves: RHEL-58820
  - plugin_bootloader: added variables to BLS entries only if grub is used
  - plugin_scheduler: do not assume that perf events have type attribute
  - plugin_scheduler: updated sched knobs for kernels 6.6+
  - plugin_scheduler: log process info when its affinity cannot be changed
  - plugin_scheduler: postpone cgroup blacklist check, double-check after fail
    resolves: RHEL-72981
  - plugin_scheduler: made perf support optional
  - plugin_net: added support for hotplug and rename
    resolves: RHEL-60906
  - makefile: added support for installation to custom $BINDIR/$SBINDIR
  - functions: dropped cpuspeed support</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.25.0-1" date="1738324800">- new release
  - rebased tuned to latest upstream
    related: RHEL-70457
  - sap-hana: Set transparent_hugepages to madvise
  - plugin_bootloader: export Grub variables to make them available in submenus
  - utils.commands: fixed CPU online detection when not present
  - plugin_net: handled cqe-mode-rx ethtool option
  - profiles: correct CPU governor settings</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.25.1-1" date="1738670400">- new release
  - rebased tuned to latest upstream
    related: RHEL-70457
  - plugins: added missing instance parameters
  - disk: added missing remove parameter
  - plugin_scheduler: added switch to disable processing of kthreads
  - Makefile: added support for installation to custom LIBEXECDIR
  - functions: create a new parser object for each string expansion
    resolves: RHEL-75773</changelog>
  <changelog author="Pavol &#x17D;&#xE1;&#x10D;ik &lt;pzacik@redhat.com&gt; - 2.25.1-2" date="1749124800">- Fix handling of kernel arguments on bootc systems
  resolves: RHEL-45836
  resolves: RHEL-86814</changelog>
  <changelog author="Jaroslav &#x160;karvada  &lt;jskarvad@redhat.com&gt; - 2.26.0-0.1.rc1" date="1755432000">- new release
  - rebased tuned to latest upstream
    resolves: RHEL-94808
  - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor
  - tuned-ppd: enabled sysfs_acpi_monitor by default
  - tuned-ppd: fixed inotify watch for performance degradation
  - tuned-ppd: pinned virtual files in memory for inotify
  - fixed instance priority inheritance
  - hotplug: added fixes for device remove race condition
  - tuned-main.conf: added startup_udev_settle_wait option
  - functions: silenced errors if module kvm_intel does not exist
    resolves: RHEL-79943
  - functions: make calc_isolated_cores return CPU ranges
    resolves: RHEL-75751
  - scsi: used 'med_power_with_dipm' for SATA ALPM
  - scsi: do not set ALPM on external SATA ports
  - network_latency: Set non-zero rcutree.nohz_full_patience_delay
  - realtime: Disable appropriate P-State drivers
    resolves: RHEL-85637
  - plugin_disk: added support for MMC (MultiMediaCard) devices
  - udev: fix possible traceback in device matcher
  - udev-settle: obey udev buffer size and handle possible tracebacks
  - daemon: re-raise daemon init exception in no-daemon mode
    resolves: RHEL-71304
  - vm: deprecate dirty_ratio in favour of dirty_bytes with percents
    resolves: RHEL-101578
  - gui: fix the profile deleter script</changelog>
  <changelog author="Jaroslav &#x160;karvada  &lt;jskarvad@redhat.com&gt; - 2.26.0-1" date="1756123200">- new release
  - rebased tuned to latest upstream
    related: RHEL-94808</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.27.0-0.1.rc1" date="1770724800">- new release
  - rebased tuned to latest upstream
    resolves: RHEL-123607
  - cpu-partitioning: autodetect dracut hook directory, systemd workaround
  - openshift: optimize TCP settings for high throughput and low latency
  - profiles: Set boost=1 in *-performance profiles
  - sap-hana: force latency to 70 us, not to C-states
  - man: fixed instance_acquire_devices example in tuned-adm man
  - spec: use correct python interpreter for documentation installation
  - sysctl: add reapply_sysctl_exclude option
  - ppd: ask tuned recommend for base profile</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.27.0-1" date="1771761600">- new release
  - rebased tuned to latest upstream
    related: RHEL-123607</changelog>
</package>
<package pkgid="c25a83db553636f0c5a63523b4ca08ba96b1371ed9b3eef04a1929b99d7e8d34" name="tuned-profiles-realtime" arch="noarch">
  <version epoch="0" ver="2.27.0" rel="2.el9_8"/>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.24.0-2" date="1731931200">- Fixed privileged execution of arbitrary scripts by active local user,
  (CVE-2024-52336)
  Resolves: RHEL-66638
- Added sanity checks for API methods parameters, (CVE-2024-52337)
  Resolves: RHEL-66615</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.25.0-0.1.rc1" date="1737288000">- new release
  - rebased tuned to latest upstream
    resolves: RHEL-70457
  - tuned-ppd: removed the use of StrEnum
  - tuned-ppd: fixed traceback
  - tuned-ppd: multiple fixes and updates
  - docs: plugins docs are now automatically generated from the docstrings
  - plugin_cpu: fixed no_turbo boolean option parsing
    resolves: RHEL-51760
  - plugin_cpu: allowed raw energy_performance_preference values
  - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters
    resolves: RHEL-58820
  - plugin_bootloader: added variables to BLS entries only if grub is used
  - plugin_scheduler: do not assume that perf events have type attribute
  - plugin_scheduler: updated sched knobs for kernels 6.6+
  - plugin_scheduler: log process info when its affinity cannot be changed
  - plugin_scheduler: postpone cgroup blacklist check, double-check after fail
    resolves: RHEL-72981
  - plugin_scheduler: made perf support optional
  - plugin_net: added support for hotplug and rename
    resolves: RHEL-60906
  - makefile: added support for installation to custom $BINDIR/$SBINDIR
  - functions: dropped cpuspeed support</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.25.0-1" date="1738324800">- new release
  - rebased tuned to latest upstream
    related: RHEL-70457
  - sap-hana: Set transparent_hugepages to madvise
  - plugin_bootloader: export Grub variables to make them available in submenus
  - utils.commands: fixed CPU online detection when not present
  - plugin_net: handled cqe-mode-rx ethtool option
  - profiles: correct CPU governor settings</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.25.1-1" date="1738670400">- new release
  - rebased tuned to latest upstream
    related: RHEL-70457
  - plugins: added missing instance parameters
  - disk: added missing remove parameter
  - plugin_scheduler: added switch to disable processing of kthreads
  - Makefile: added support for installation to custom LIBEXECDIR
  - functions: create a new parser object for each string expansion
    resolves: RHEL-75773</changelog>
  <changelog author="Pavol &#x17D;&#xE1;&#x10D;ik &lt;pzacik@redhat.com&gt; - 2.25.1-2" date="1749124800">- Fix handling of kernel arguments on bootc systems
  resolves: RHEL-45836
  resolves: RHEL-86814</changelog>
  <changelog author="Jaroslav &#x160;karvada  &lt;jskarvad@redhat.com&gt; - 2.26.0-0.1.rc1" date="1755432000">- new release
  - rebased tuned to latest upstream
    resolves: RHEL-94808
  - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor
  - tuned-ppd: enabled sysfs_acpi_monitor by default
  - tuned-ppd: fixed inotify watch for performance degradation
  - tuned-ppd: pinned virtual files in memory for inotify
  - fixed instance priority inheritance
  - hotplug: added fixes for device remove race condition
  - tuned-main.conf: added startup_udev_settle_wait option
  - functions: silenced errors if module kvm_intel does not exist
    resolves: RHEL-79943
  - functions: make calc_isolated_cores return CPU ranges
    resolves: RHEL-75751
  - scsi: used 'med_power_with_dipm' for SATA ALPM
  - scsi: do not set ALPM on external SATA ports
  - network_latency: Set non-zero rcutree.nohz_full_patience_delay
  - realtime: Disable appropriate P-State drivers
    resolves: RHEL-85637
  - plugin_disk: added support for MMC (MultiMediaCard) devices
  - udev: fix possible traceback in device matcher
  - udev-settle: obey udev buffer size and handle possible tracebacks
  - daemon: re-raise daemon init exception in no-daemon mode
    resolves: RHEL-71304
  - vm: deprecate dirty_ratio in favour of dirty_bytes with percents
    resolves: RHEL-101578
  - gui: fix the profile deleter script</changelog>
  <changelog author="Jaroslav &#x160;karvada  &lt;jskarvad@redhat.com&gt; - 2.26.0-1" date="1756123200">- new release
  - rebased tuned to latest upstream
    related: RHEL-94808</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.27.0-0.1.rc1" date="1770724800">- new release
  - rebased tuned to latest upstream
    resolves: RHEL-123607
  - cpu-partitioning: autodetect dracut hook directory, systemd workaround
  - openshift: optimize TCP settings for high throughput and low latency
  - profiles: Set boost=1 in *-performance profiles
  - sap-hana: force latency to 70 us, not to C-states
  - man: fixed instance_acquire_devices example in tuned-adm man
  - spec: use correct python interpreter for documentation installation
  - sysctl: add reapply_sysctl_exclude option
  - ppd: ask tuned recommend for base profile</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.27.0-1" date="1771761600">- new release
  - rebased tuned to latest upstream
    related: RHEL-123607</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.27.0-2" date="1781524800">- net: added more coalescing options, filter out unsupported ones
  resolves: RHEL-181668</changelog>
</package>
</otherdata>