# changelog

author: Than Ngo <than@redhat.com> - 3.24.0-1
changelog:
  - Resolves: RHEL-50064, update to 3.24.0
  - Resolves: RHEL-50063, opencryptoki CCA Token support for x86_64 and ppc64le
  - Resolves: RHEL-50058, openCryptoki CCA token support of Dilithium
  - Resolves: RHEL-50056, openCryptoki cca token SHA3 support
  - Resolves: RHEL-50057, openCryptoki cca token RSA OAEP v2.1 support


author: Simon Pichugin <spichugi@redhat.com> - 2.6.8-1
changelog:
  - Rebase to version 2.6.8 (RHEL-71053)
  - Avoid SSL context cleanup during library destruction (RHEL-56502)


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.7p1-44
changelog:
  - Add extra help information on ssh early failure
    Resolves: RHEL-33809
  - Provide details on crypto error instead of "error in libcrypto"
    Resolves: RHEL-52293
  - Allow duplicate Subsystem directive
    Resolves: RHEL-47112


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.7p1-45
changelog:
  - Fix missing error codes set and invalid error code checks in OpenSSH. It
    prevents memory exhaustion attack and a MITM attack when VerifyHostKeyDNS
    is on (CVE-2025-26465).
    Resolves: RHEL-78700


author: Zoltan Fridrich <zfridric@redhat.com> - 0.25.3-3
changelog:
  - Fix regression in trust where file creation fails for long cert labels
    Resolves: RHEL-58899
  - Fix usage message in p11-kit list-tokens command
    Resolves: RHEL-31810


author: Iker Pedrosa <ipedrosa@redhat.com> - 1.5.1-22
changelog:
  - pam_unix: always run the helper to obtain shadow password file entries.
    CVE-2024-10041. Resolves: RHEL-62879
  - pam_access: always match local address and clarify LOCAL keyword behaviour.
    Resolves: RHEL-23631 and RHEL-39943


author: Brian C. Lane <bcl@redhat.com> - 3.5-3
changelog:
  - tests: Add test for dvh with a bad checksum (bcl)
    Related: RHEL-73217
  - libparted: Fix dvh disklabel unhandled exception (bcl)
    Related: RHEL-73217
  - tests: Add test for SUN disklabel handling (bcl)
    Related: RHEL-73217
  - libparted: Fix sun disklabel unhandled exception (bcl)
    Resolves: RHEL-73217


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.9.21-1
changelog:
  - Update to 3.9.21
  - Security fix for CVE-2024-11168 and CVE-2024-9287
  Resolves: RHEL-64889
  Resolves: RHEL-69942


author: Michal Domonkos <mdomonko@redhat.com> - 4.16.1.3-35
changelog:
  - Fix %patch N applying Patch0 implicitly (RHEL-6294)
  - Issue deprecation warning for number-less %patch (RHEL-6294)


author: Michal Domonkos <mdomonko@redhat.com> - 4.16.1.3-37
changelog:
  - Allow parametric macros to opt out of option processing (RHEL-67161)
  - Report unsafe symlinks during installation as a specific case (RHEL-33393)
  - Fix FA_TOUCH'ed files getting removed on failed update (RHEL-63070)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-49
changelog:
  - logind: tighten for which classes of sessions we do stop-on-idle (RHEL-24340)
  - Fix configuration for Packit 1.0.0 (RHEL-70884)
  - udev/net_id: introduce naming scheme for RHEL-9.6 (RHEL-25515)
  - hwdb: Fix accelerometer mount matrix for ASUS T100TAS (RHEL-49810)
  - hwdb.d/60-keyboard.hwdb: add Clevo mic mute quirk for V5x dGPU (RHEL-49810)
  - hwdb: add entry for Dell AlpsPS/2 ALPS DualPoint TouchPad (RHEL-49810)
  - hwdb: Mark Apple Wireless keyboards as not having NumLock LED (RHEL-49810)
  - update keyboard hwdb to add acer Predator PHN16-72 (RHEL-49810)
  - hwdb: death to tabs! (RHEL-49810)
  -  hwdb.d/60-keyboard.hwdb: add Clevo mic mute quirk for V5x iGPU, NV41PZ (RHEL-49810)
  - Add ACCEL_MOUNT_MATRIX for Chuwi Hi10 Max. (RHEL-49810)
  - Add HUAWEI MateBook D 15 AMD ACCEL properties (RHEL-49810)
  - hwdb: add Kensington SlimBlade Pro trackball (Bluetooth mode) (RHEL-49810)
  - hwdb: Add accel orientation quirk for the IdeaPad Duet 3 10IGL5-LTE (RHEL-49810)
  - hwdb: add keymaps for Acer Nitro 5 AN515-47 (#34493) (RHEL-49810)
  - hwdb: make key map match comment for one laptop (RHEL-49810)
  - hwdb: there's KEY_BRIGHTNESS_AUTO these days, hence hook it up where a FIXME suggests that (RHEL-49810)
  - hwdb: use KEY_ROTATE_DISPLAY for various cases of display rotation keys (RHEL-49810)
  - hwbd: use newer KEY_PICKUP_PHONE, KEY_HANGUP_PHONE, KEY_SELECTIVE_SCREENSHOT, KEY_NOTIFICATION_CENTER keycodes where appropriate (RHEL-49810)
  - hwdb: add SCAI SKU prefix for Samsung keyboard mapping (#34648) (RHEL-49810)
  - tree-wide: drop doubled empty lines (RHEL-49810)
  - hwdb: move key 66/65 handling from specific to generic HP laptop coverage (RHEL-49810)
  - hwdb: fix key toggle touchpad and programmable buttom for Positivo V142N (#34725) (RHEL-49810)
  - hwdb: add Stream Deck Neo (#34903) (RHEL-49810)
  - hwdb: update autosuspend rules (RHEL-49810)
  - hwdb: import newest autosuspend rules from chromeos (RHEL-49810)
  - update hwdb (RHEL-49810)
  - Update hwdb (RHEL-49810)
  - hwdb: fix broken numpad paren keys on Lenovo Thinkbook 16 G6+ 2024 (RHEL-49810)
  - Update hwdb (RHEL-49810)
  - hwdb: add new Cube Mix Plus (i18D) rotation info (RHEL-49810)
  - hwdb: Add quirk for Logitech MX Keys for Mac (RHEL-49810)
  - hwdb: add support for PineTab2 to 60-sensor.hwdb (#35304) (RHEL-49810)
  - hwdb: add entry for Chuwi Hi10 X1 (#35331) (RHEL-49810)
  - hwdb: update (RHEL-49810)
  - hwdb: Make 3D mice work out-of-the-box (RHEL-49810)
  - hwdb: Add Chuwi MiniBook X trackpad fuzz (RHEL-49810)
  - Update hwdb (RHEL-49810)
  - hwdb: disable inclusion of the PCI domain in MANA network interface naming (RHEL-49810)
  - hwdb: move down touchpad toggle section from generic to product specific (RHEL-49810)
  - hwdb: add scancodes for HP Elitebook 2170p runnning coreboot (RHEL-49810)
  - hwdb: Make remote controllable lights work out-of-the-box (RHEL-49810)
  - hwdb: fix key toggle touchpad for VAIO VJFH52 (#35645) (RHEL-49810)
  - hwdb: comment out the entry for Logitech MX Keys for Mac (RHEL-49810)
  - 60-sensor.hwdb: Loosen model mask to include entire series (RHEL-49810)
  - Correct ACCEL_MOUNT_MATRIX for Chuwi Hi10 Max (RHEL-49810)
  - hwdb: Add macro keys for HP 430 Programmable Wireless Keypad (RHEL-49810)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-50
changelog:
  - journal: again create user journals for users with high uids (RHEL-70103)
  - install: don't translate unit instances to paths when reenabling them (RHEL-5956)
  - test-systemctl-enable: fix typo (RHEL-5956)
  - udev: Handle PTP device symlink properly on udev action 'change' (RHEL-59088)
  - systemctl: print warning about missing /proc only as debug message (RHEL-3906)
  - repart: avoid use of uninitialized TPM2B_PUBLIC data (RHEL-56793)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-51
changelog:
  - ci: use ubuntu 22:04 for deploy of man pages (RHEL-70884)
  - man/tmpfiles: fix off-by-one in example (RHEL-74015)
  - test: drop removed SCSI passthrough feature (RHEL-70884)
  - nspawn: call json_dispatch() with a correct pointer (RHEL-55266)
  - varlink,json: introduce new varlink_dispatch() helper (RHEL-55266)
  - json: add json_dispatch_const_user_group_name() (RHEL-55266)
  - sd-varlink: add new sd_varlink_error_is_invalid_parameter() helper (RHEL-55266)
  - userdb: return ESRCH if userdb service refuses a user/group name as invalid (RHEL-55266)
  - test: rename assert.sh to util.sh (RHEL-55301)
  - core: Don't GC unit if it is in cgroup_empty_queue (RHEL-55301)
  - core: Handle cgroup pruning in on_cgroup_empty_event (RHEL-55301)
  - Fix failing test (RHEL-55301)
  - unit: don't gc unit in oom queue (RHEL-55301)
  - core: do not GC units/jobs that are in the D-Bus queue (RHEL-55301)


author: Vladis Dronov <vdronov@redhat.com> - 6.16-7
changelog:
  - Update to the upstream v6.16 + tip of origin/master @ 98cf8d63 (RHEL-30953)
  - Use proper SPDX license identifiers
  - Fix a test failure


author: Vladis Dronov <vdronov@redhat.com> - 6.17-1
changelog:
  - Add Intel CET IBT instrumentation to assembly code
  - Update to the upstream v6.17 @ ac43f912 (RHEL-64951)


author: Michal Ruprich <mruprich@redhat.com> - 3.2.3-21
changelog:
  - Resolves: RHEL-70265 - Rebase rsync to 3.2.5
  - Resolves: RHEL-67142 - Wrong progress reported by rsync when using copy-devices
  - Resolves: RHEL-29340 - Slowness in rsync due to extra validation steps.
  - Resolves: RHEL-18216 - rysnc script /usr/share/doc/rsync/support/rrsync is unsecure


author: Michal Ruprich <mruprich@redhat.com> - 3.2.5-2
changelog:
  - Resolves: RHEL-70158 - Info Leak via Uninitialized Stack Contents
  - Resolves: RHEL-70208 - Path traversal vulnerability in rsync
  - Resolves: RHEL-70210 - --safe-links option bypass leads to path traversal
  - Resolves: RHEL-71657 - Race Condition in rsync Handling Symbolic Links


author: Zdenek Pytela <zpytela@redhat.com> - 35.1.46-1
changelog:
  - Label /run/modprobe.d with modules_conf_t
  Resolves: RHEL-61453
  - Allow boothd connect to kernel over a unix socket
  Resolves: RHEL-57104
  - Allow boothd connect to systemd-userdbd over a unix socket
  Resolves: RHEL-57104
  - Additional updates stalld policy for bpf usage
  Resolves: RHEL-57075
  - Update stalld policy for bpf usage
  Resolves: RHEL-57075
  - Allow ptp4l the sys_admin capability
  Resolves: RHEL-55133
  - Label /dev/hfi1_[0-9]+ devices
  Resolves: RHEL-54996
  - Confine iio-sensor-proxy
  Resolves: RHEL-17346


author: Zdenek Pytela <zpytela@redhat.com> - 38.1.47-1
changelog:
  - Label /etc/sysctl.d and /run/sysctl.d with system_conf_t
  Resolves: RHEL-56988
  - Allow lldpad create and use netlink_generic_socket
  Resolves: RHEL-61832
  - Allow unconfined_t execute kmod in the kmod domain
  Resolves: RHEL-54710
  - Allow confined users r/w to screen unix stream socket
  Resolves: RHEL-50379
  - Label /root/.screenrc and /root/.tmux.conf with screen_home_t
  Resolves: RHEL-50375
  - Allow iio-sensor-proxy the bpf capability
  Resolves: RHEL-17346


author: Zdenek Pytela <zpytela@redhat.com> - 38.1.48-1
changelog:
  - Revert "Allow unconfined_t execute kmod in the kmod domain"
  Resolves: RHEL-65008
  - Add policy for /usr/libexec/samba/samba-bgqd
  Resolves: RHEL-53124


author: Zdenek Pytela <zpytela@redhat.com> - 38.1.49-1
changelog:
  - Update virtlogd policy
  Resolves: RHEL-69433
  - Allow svirt_t the sys_rawio capability
  Resolves: RHEL-56955
  - Allow qemu-ga the dac_override and dac_read_search capabilities
  Resolves: RHEL-52476
  - Allow ip the setexec permission
  Resolves: RHEL-62923
  - Allow alsa get attributes filesystems with extended attributes
  Resolves: RHEL-61472
  - Allow bacula execute container in the container domain
  Resolves: RHEL-21168
  - Allow httpd get attributes of dirsrv unit files
  Resolves: RHEL-46808
  - Update samba-bgqd policy
  Resolves: RHEL-69517
  - Allow samba-bgqd read cups config files
  Resolves: RHEL-69517
  - Update policy for samba-bgqd
  Resolves: RHEL-69517
  - Update bootupd policy for the removing-state-file test
  Resolves: RHEL-66584
  - Allow qatlib search the content of the kernel debugging filesystem
  Resolves: RHEL-53864
  - Allow qatlib connect to systemd-machined over a unix socket
  Resolves: RHEL-53864
  - Update qatlib policy for v24.02 with new features
  Resolves: RHEL-53864


author: Zdenek Pytela <zpytela@redhat.com> - 38.1.50-1
changelog:
  - Allow auditctl signal auditd
  Resolves: RHEL-68969
  - Fix the cups_read_pid_files() interface to use read_files_pattern
  Resolves: RHEL-69517
  - Dontaudit systemd-coredump the sys_resource capability
  Resolves: RHEL-46339
  - Allow rpcd read network sysctls
  Resolves: RHEL-1558
  - Allow irqbalance setpcap capability in the user namespace
  Resolves: RHEL-69564
  - Allow traceroute_t bind rawip sockets to unreserved ports
  Resolves: RHEL-54561
  - Allow svirt_t the sys_rawio capability
  Resolves: RHEL-56955
  - Change /run/sysctl\.d(/.*)? fc entry to /var/run/sysctl\.d(/.*)?
  Resolves: RHEL-56988
  - Exclude container-selinux manpage from selinux-policy-doc
  Resolves: RHEL-69916


author: Zdenek Pytela <zpytela@redhat.com> - 38.1.51-1
changelog:
  - Allow rsyslog read systemd-logind session files
  Resolves: RHEL-73839
  - Allow samba-bgqd connect to cupsd over an unix domain stream socket
  Resolves: RHEL-72860
  - Allow svirt_t read sysfs files
  Resolves: RHEL-70839
  - Allow xdm dbus chat with power-profiles-daemon
  Resolves: RHEL-61117
  - Update power-profiles-daemon policy
  Resolves: RHEL-61117
  - Confine power-profiles-daemon
  Resolves: RHEL-61117
  - Allow virtqemud domain transition to nbdkit
  Resolves: RHEL-56029
  - Add nbdkit interfaces defined conditionally
  Resolves: RHEL-56029
  - Confine the switcheroo-control service
  Resolves: RHEL-24268


author: Zdenek Pytela <zpytela@redhat.com> - 38.1.52-1
changelog:
  - Add the files_read_root_files() interface
  Resolves: RHEL-70849
  - Dontaudit systemd-logind remove all files
  Resolves: RHEL-59145
  - Add the files_dontaudit_read_all_dirs() interface
  Resolves: RHEL-59145
  - Add the files_dontaudit_delete_all_files() interface
  Resolves: RHEL-59145
  - Allow rhsmcertd notify virt-who
  Resolves: RHEL-77152
  - Allow irqbalance to run unconfined scripts conditionally
  Resolves: RHEL-1556
  - Backport bootupd policy from current Fedora rawhide
  Resolves: RHEL-70849
  - Support using systemd containers
  Resolves: RHEL-76352
  - Allow svirt_t connect to unconfined_t over a unix domain socket
  Resolves: RHEL-37539
  - Allow virt_domain to use pulseaudio - conditional
  Resolves: RHEL-1379
  - Allow telnetd read network sysctls
  Resolves: RHEL-58825
  - Allow alsa watch generic device directories
  Resolves: RHEL-61472
  - Update switcheroo policy
  Resolves: RHEL-24268


author: Zdenek Pytela <zpytela@redhat.com> - 38.1.53-1
changelog:
  - Allow svirt_t to connect to nbdkit over a unix stream socket
  Resolves: RHEL-56029
  - Allow power-profiles-daemon the bpf capability
  Resolves: RHEL-61117
  - Allow systemd-machined the kill user-namespace capability
  Resolves: RHEL-76352


author: Eugene Syromiatnikov <esyr@redhat.com> - 6.7-1
changelog:
  - Rebase to v6.7; drop upstream patches on top of 5.18 (RHEL-8646).
  - Updated the SPDX license expression.


author: Eugene Syromiatnikov <esyr@redhat.com> - 6.7-2
changelog:
  - Fix incorrect syscall name reporting in restart_syscall() on attach when
    PTRACE_GET_SYSCALL_INFO is in use (RHEL-65109).
  - Update net-yy-inet* and linkat--secontext_mismatch tests.


author: Eugene Syromiatnikov <esyr@redhat.com> - 6.12-1
changelog:
  - Rebase to v6.12; drop upstream patches on top of 6.7, drop the harcoded
    "-isystem /usr/include" from CPPFLAGS (RHEL-8646).


author: Jan Macku <jamacku@redhat.com> - 3:2.1.1-1
changelog:
  - rebase to 2.1.1 (RHEL-67117)
      Interpret ipv4-mapped ipv6 addresses (::ffff:A.B.C.D) as true ipv4.

  	   There are no ipv4-mapped addresses in the real network which we
  	   operate on, so use just ipv4 in such cases, but allow users
  	   to specify it this way for convenience.

  	  Return back more robast poll(2) loop handling.


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.24.0-2
changelog:
  - Fixed privileged execution of arbitrary scripts by active local user,
    (CVE-2024-52336)
    Resolves: RHEL-66638
  - Added sanity checks for API methods parameters, (CVE-2024-52337)
    Resolves: RHEL-66615


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.25.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: RHEL-70457
    - tuned-ppd: removed the use of StrEnum
    - tuned-ppd: fixed traceback
    - tuned-ppd: multiple fixes and updates
    - docs: plugins docs are now automatically generated from the docstrings
    - plugin_cpu: fixed no_turbo boolean option parsing
      resolves: RHEL-51760
    - plugin_cpu: allowed raw energy_performance_preference values
    - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters
      resolves: RHEL-58820
    - plugin_bootloader: added variables to BLS entries only if grub is used
    - plugin_scheduler: do not assume that perf events have type attribute
    - plugin_scheduler: updated sched knobs for kernels 6.6+
    - plugin_scheduler: log process info when its affinity cannot be changed
    - plugin_scheduler: postpone cgroup blacklist check, double-check after fail
      resolves: RHEL-72981
    - plugin_scheduler: made perf support optional
    - plugin_net: added support for hotplug and rename
      resolves: RHEL-60906
    - makefile: added support for installation to custom $BINDIR/$SBINDIR
    - functions: dropped cpuspeed support


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.25.0-1
changelog:
  - new release
    - rebased tuned to latest upstream
      related: RHEL-70457
    - sap-hana: Set transparent_hugepages to madvise
    - plugin_bootloader: export Grub variables to make them available in submenus
    - utils.commands: fixed CPU online detection when not present
    - plugin_net: handled cqe-mode-rx ethtool option
    - profiles: correct CPU governor settings


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.25.1-1
changelog:
  - new release
    - rebased tuned to latest upstream
      related: RHEL-70457
    - plugins: added missing instance parameters
    - disk: added missing remove parameter
    - plugin_scheduler: added switch to disable processing of kthreads
    - Makefile: added support for installation to custom LIBEXECDIR
    - functions: create a new parser object for each string expansion
      resolves: RHEL-75773


author: Vladimír Beneš <vbenes@redhat.com> - 1:1.52.0-3
changelog:
  - Invalid memory access on Dnsconfd DBUS error (RHEL-84692)
  - Support IP configuration for secondary interfaces on Oracle VM from metadata (RHEL-84695)


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.13.1.el9_6]
changelog:
  - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83049]
  - hv_netvsc: Fix VF namespace also in synthetic NIC NETDEV_REGISTER event (Maxim Levitsky) [RHEL-85942]
  - net: netvsc: Update default VMBus channels (Maxim Levitsky) [RHEL-85942]
  - net: mana: cleanup mana struct after debugfs_remove() (Maxim Levitsky) [RHEL-85942]
  - net: mana: Cleanup "mana" debugfs dir after cleanup of all children (Maxim Levitsky) [RHEL-85942]
  - net: mana: Fix irq_contexts memory leak in mana_gd_setup_irqs (Maxim Levitsky) [RHEL-85942]
  - net: mana: Fix memory leak in mana_gd_setup_irqs (Maxim Levitsky) [RHEL-85942]
  - net :mana :Request a V2 response version for MANA_QUERY_GF_STAT (Maxim Levitsky) [RHEL-85942]
  - net: mana: use ethtool string helpers (Maxim Levitsky) [RHEL-85942]
  - net: mana: Enable debugfs files for MANA device (Maxim Levitsky) [RHEL-85942]
  - net: mana: Add get_link and get_link_ksettings in ethtool (Maxim Levitsky) [RHEL-85942]
  - net: mana: Increase the DEF_RX_BUFFERS_PER_QUEUE to 1024 (Maxim Levitsky) [RHEL-85942]
  - net: mana: Improve mana_set_channels() in low mem conditions (Maxim Levitsky) [RHEL-85942]
  - net: mana: Implement get_ringparam/set_ringparam for mana (Maxim Levitsky) [RHEL-85942]
  - net: mana: Fix error handling in mana_create_txq/rxq's NAPI cleanup (Maxim Levitsky) [RHEL-85942]
  - ice: Fix signedness bug in ice_init_interrupt_scheme() (Petr Oros) [RHEL-80557]
  - ice: init flow director before RDMA (Petr Oros) [RHEL-80557]
  - ice: simplify VF MSI-X managing (Petr Oros) [RHEL-80557]
  - ice: enable_rdma devlink param (Petr Oros) [RHEL-80557]
  - ice: treat dyn_allowed only as suggestion (Petr Oros) [RHEL-80557]
  - ice, irdma: move interrupts code to irdma (Petr Oros) [RHEL-80557]
  - ice: get rid of num_lan_msix field (Petr Oros) [RHEL-80557]
  - ice: remove splitting MSI-X between features (Petr Oros) [RHEL-80557]
  - ice: devlink PF MSI-X max and min parameter (Petr Oros) [RHEL-80557]
  - ice: ice_probe: init ice_adapter after HW init (Petr Oros) [RHEL-80557]
  - ice: minor: rename goto labels from err to unroll (Petr Oros) [RHEL-80557]
  - ice: split ice_init_hw() out from ice_init_dev() (Petr Oros) [RHEL-80557]
  - ice: c827: move wait for FW to ice_init_hw() (Petr Oros) [RHEL-80557]
  - smb: client: don't retry IO on failed negprotos with soft mounts (Jay Shin) [RHEL-85524]
  - cgroup: Remove steal time from usage_usec (Waiman Long) [RHEL-85398]
  - rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read (CKI Backport Bot) [RHEL-85395] {CVE-2024-58069}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.14.1.el9_6]
changelog:
  - smb: client: fix regression with guest option (Paulo Alcantara) [RHEL-83859]
  - io_uring/sqpoll: zero sqd->thread on tctx errors (CKI Backport Bot) [RHEL-87264] {CVE-2025-21633}
  - nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Chris Leech) [RHEL-86915] {CVE-2025-21927}
  - iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic() (CKI Backport Bot) [RHEL-86840] {CVE-2025-21993}
  - certs: Add ECDSA signature verification self-test (Herbert Xu) [RHEL-82247]
  - certs: Move RSA self-test data to separate file (Herbert Xu) [RHEL-82247]
  - certs: Break circular dependency when selftest is modular (Herbert Xu) [RHEL-82247]
  - KEYS: Include linux/errno.h in linux/verification.h (Herbert Xu) [RHEL-82247]
  - crypto: certs: fix FIPS selftest dependency (Herbert Xu) [RHEL-82247]
  - New configs in certs/Kconfig (Fedora Kernel Team) [RHEL-82247]
  - certs: Add support for using elliptic curve keys for signing modules (Herbert Xu) [RHEL-82247]
  - certs: Trigger creation of RSA module signing key if it's not an RSA key (Herbert Xu) [RHEL-82247]
  - tpm: Change to kvalloc() in eventlog/acpi.c (Štěpán Horáček) [RHEL-82147] {CVE-2024-58005}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.15.1.el9_6]
changelog:
  - ice: ensure periodic output start time is in the future (Petr Oros) [RHEL-86021]
  - ice: fix PHY Clock Recovery availability check (Petr Oros) [RHEL-86021]
  - ice: Drop auxbus use for PTP to finalize ice_adapter move (Petr Oros) [RHEL-86021]
  - ice: Use ice_adapter for PTP shared data instead of auxdev (Petr Oros) [RHEL-86021]
  - ice: Initial support for E825C hardware in ice_adapter (Petr Oros) [RHEL-86021]
  - ice: Add ice_get_ctrl_ptp() wrapper to simplify the code (Petr Oros) [RHEL-86021]
  - ice: Introduce ice_get_phy_model() wrapper (Petr Oros) [RHEL-86021]
  - ice: Enable 1PPS out from CGU for E825C products (Petr Oros) [RHEL-86021]
  - ice: Read SDP section from NVM for pin definitions (Petr Oros) [RHEL-86021]
  - ice: Disable shared pin on E810 on setfunc (Petr Oros) [RHEL-86021]
  - ice: Cache perout/extts requests and check flags (Petr Oros) [RHEL-86021]
  - ice: Align E810T GPIO to other products (Petr Oros) [RHEL-86021]
  - ice: Add SDPs support for E825C (Petr Oros) [RHEL-86021]
  - ice: Implement ice_ptp_pin_desc (Petr Oros) [RHEL-86021]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.16.1.el9_6]
changelog:
  - soc: qcom: socinfo: Avoid out of bounds read of serial number (Jared Kangas) [RHEL-88252] {CVE-2024-58007}
  - soc: qcom: socinfo: fix revision check in qcom_socinfo_probe() (Jared Kangas) [RHEL-88252]
  - soc: qcom: Add check devm_kasprintf() returned value (Jared Kangas) [RHEL-88252]


author: Patrick Talbert <ptalbert@redhat.com> [5.14.0-570.17.1.el9_6]
changelog:
  - vsock: Orphan socket after transport release (Jay Shin) [RHEL-89113] {CVE-2025-21756}
  - vsock: Keep the binding until socket destruction (Jay Shin) [RHEL-89113] {CVE-2025-21756}
  - bpf, vsock: Invoke proto::close on close() (Jay Shin) [RHEL-89113] {CVE-2025-21756}
  - net: ppp: Add bound checking for skb data on ppp_sync_txmung (Guillaume Nault) [RHEL-89646] {CVE-2025-37749}
  - cgroup/cpuset: Add warnings to catch inconsistency in exclusive CPUs (Waiman Long) [RHEL-88640]
  - selftest/cgroup: Add a remote partition transition test to test_cpuset_prs.sh (Waiman Long) [RHEL-88640]
  - selftest/cgroup: Clean up and restructure test_cpuset_prs.sh (Waiman Long) [RHEL-88640]
  - selftest/cgroup: Update test_cpuset_prs.sh to use | as effective CPUs and state separator (Waiman Long) [RHEL-88640]
  - cgroup/cpuset: Code cleanup and comment update (Waiman Long) [RHEL-88640]
  - cgroup/cpuset: Remove remote_partition_check() & make update_cpumasks_hier() handle remote partition (Waiman Long) [RHEL-88640]
  - cgroup/cpuset: Fix error handling in remote_partition_disable() (Waiman Long) [RHEL-88640]
  - cgroup/cpuset: Fix incorrect isolated_cpus update in update_parent_effective_cpumask() (Waiman Long) [RHEL-88640]
  - cgroup/cpuset: Fix race between newly created partition and dying one (Waiman Long) [RHEL-88640]
  - cgroup/cpuset: Prevent leakage of isolated CPUs into sched domains (Waiman Long) [RHEL-88640]
  - cgroup/cpuset: Enforce at most one rebuild_sched_domains_locked() call per operation (Waiman Long) [RHEL-88640]
  - cgroup/cpuset: Revert "Allow suppression of sched domain rebuild in update_cpumasks_hier()" (Waiman Long) [RHEL-88640]
  - cgroup/cpuset: Fix spelling errors in file kernel/cgroup/cpuset.c (Waiman Long) [RHEL-88640]
  - selftest/cgroup: Make test_cpuset_prs.sh deal with pre-isolated CPUs (Waiman Long) [RHEL-88640]
  - cgroup/cpuset: Account for boot time isolated CPUs (Waiman Long) [RHEL-88640]
  - cgroup/cpuset: remove use_parent_ecpus of cpuset (Waiman Long) [RHEL-88640]
  - cgroup/cpuset: remove fetch_xcpus (Waiman Long) [RHEL-88640]
  - selftest/cgroup: Add new test cases to test_cpuset_prs.sh (Waiman Long) [RHEL-88640]
  - cgroup/cpuset: remove child_ecpus_count (Waiman Long) [RHEL-88640]
  - cpuset: use Union-Find to optimize the merging of cpumasks (Waiman Long) [RHEL-88640]
  - Union-Find: add a new module in kernel library (Waiman Long) [RHEL-88640]
  - dm-flakey: Fix memory corruption in optional corrupt_bio_byte feature (CKI Backport Bot) [RHEL-86899] {CVE-2025-21966}
  - ixgbe: fix media type detection for E610 device (Corinna Vinschen) [RHEL-85809]
  - ixgbevf: Add support for Intel(R) E610 device (Corinna Vinschen) [RHEL-85809]
  - PCI: Add PCI_VDEVICE_SUB helper macro (Corinna Vinschen) [RHEL-85809]
  - ixgbe: fix media cage present detection for E610 device (Corinna Vinschen) [RHEL-85809]
  - ixgbe: Enable link management in E610 device (Corinna Vinschen) [RHEL-85809]
  - ixgbe: Clean up the E610 link management related code (Corinna Vinschen) [RHEL-85809]
  - ixgbe: Add ixgbe_x540 multiple header inclusion protection (Corinna Vinschen) [RHEL-85809]
  - ixgbe: Add support for EEPROM dump in E610 device (Corinna Vinschen) [RHEL-85809]
  - ixgbe: Add support for NVM handling in E610 device (Corinna Vinschen) [RHEL-85809]
  - ixgbe: Add link management support for E610 device (Corinna Vinschen) [RHEL-85809]
  - ixgbe: Add support for E610 device capabilities detection (Corinna Vinschen) [RHEL-85809]
  - ixgbe: Add support for E610 FW Admin Command Interface (Corinna Vinschen) [RHEL-85809]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.18.1.el9_6]
changelog:
  - gitlab-ci: use rhel9.6 builder image (Michael Hofmann)
  - cifs: Fix integer overflow while processing acregmax mount option (CKI Backport Bot) [RHEL-87921] {CVE-2025-21964}
  - Bluetooth: btusb: Add one more ID 0x0489:0xe0f3 for Qualcomm WCN785x (David Marlin) [RHEL-85647]
  - drm/i915/dp_mst: Don't require DSC hblank quirk for a non-DSC compatible mode (Jocelyn Falempe) [RHEL-85393]
  - drm/i915/dp_mst: Handle error during DSC BW overhead/slice calculation (Jocelyn Falempe) [RHEL-85393]
  - drm/i915/display: Use joined pipes in dsc helpers for slices, bpp (Jocelyn Falempe) [RHEL-85393]
  - drm/i915/display: Use joined pipes in intel_mode_valid_max_plane_size (Jocelyn Falempe) [RHEL-85393]
  - drm/i915/display: Use joined pipes in intel_dp_joiner_needs_dsc (Jocelyn Falempe) [RHEL-85393]
  - drm/i915/display: Simplify intel_joiner_num_pipes and its usage (Jocelyn Falempe) [RHEL-85393]
  - drm/i915/display: Check whether platform supports joiner (Jocelyn Falempe) [RHEL-85393]
  - Revert "drm/i915/dp_mst: Handle error during DSC BW overhead/slice calculation" (Jocelyn Falempe) [RHEL-85393]
  - Revert "drm/i915/dp_mst: Don't require DSC hblank quirk for a non-DSC compatible mode" (Jocelyn Falempe) [RHEL-85393]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.19.1.el9_6]
changelog:
  - misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os (David Arcari) [RHEL-87254] {CVE-2022-3424}
  - ndisc: use RCU protection in ndisc_alloc_skb() (Xin Long) [RHEL-89546] {CVE-2025-21764}
  - ipv6: use RCU protection in ip6_default_advmss() (Xin Long) [RHEL-89546] {CVE-2025-21765}
  - net: add dev_net_rcu() helper (Xin Long) [RHEL-89546] {CVE-2025-21765}
  - page_pool: Track DMA-mapped pages and unmap them when destroying the pool (Toke Høiland-Jørgensen) [RHEL-84151]
  - page_pool: Move pp_magic check into helper functions (Toke Høiland-Jørgensen) [RHEL-84151]
  - ext4: fallback to complex scan if aligned scan doesn't work (Jay Shin) [RHEL-85984]
  - drm/mgag200: Added support for the new device G200eH5 (Jocelyn Falempe) [RHEL-88907]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.20.1.el9_6]
changelog:
  - wifi: ath12k: Fix invalid data access in ath12k_dp_rx_h_undecap_nwifi (CKI Backport Bot) [RHEL-93253] {CVE-2025-37943}
  - ext4: fix OOB read when checking dotdot dir (CKI Backport Bot) [RHEL-87985] {CVE-2025-37785}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.21.1.el9_6]
changelog:
  - xsk: fix an integer overflow in xp_create_and_assign_umem() (CKI Backport Bot) [RHEL-87911] {CVE-2025-21997}
  - vlan: enforce underlying device type (Guillaume Nault) [RHEL-87884] {CVE-2025-21920}
  - net: fix geneve_opt length integer overflow (Guillaume Nault) [RHEL-87974] {CVE-2025-22055}
  - net: gso: fix ownership in __udp_gso_segment (CKI Backport Bot) [RHEL-88333] {CVE-2025-21926}


author: Ben Procknow <bprockno@redhat.com> [1-1.el9_6]
changelog:
  - kernel: wifi: ath12k: Fix invalid data access in ath12k_dp_rx_h_undecap_nwifi [RHEL-93732] {CVE-2025-37943}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.22.1.el9_6]
changelog:
  - Bluetooth: L2CAP: Fix corrupted list in hci_chan_del (David Marlin) [RHEL-87890] {CVE-2025-21969}
  - Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd (David Marlin) [RHEL-87890] {CVE-2025-21969}
  - Revert "SUNRPC: Revert e0a912e8ddba" (Benjamin Coddington) [RHEL-94811]
  - mm/hugetlb: fix kernel NULL pointer dereference when migrating hugetlb folio (Jay Shin) [RHEL-92291]
  - mm: fix crashes from deferred split racing folio migration (Jay Shin) [RHEL-92291] {CVE-2024-42234}
  - mm: memcg: fix split queue list crash when large folio migration (Jay Shin) [RHEL-92291]
  - proc: fix UAF in proc_get_inode() (Ian Kent) [RHEL-86808] {CVE-2025-21999}
  - cifs: Fix integer overflow while processing acdirmax mount option (Paulo Alcantara) [RHEL-87941] {CVE-2025-21963}
  - wifi: cfg80211: init wiphy_work before allocating rfkill fails (CKI Backport Bot) [RHEL-87931] {CVE-2025-21979}
  - wifi: cfg80211: cancel wiphy_work before freeing wiphy (CKI Backport Bot) [RHEL-87931] {CVE-2025-21979}
  - eth: bnxt: fix truesize for mb-xdp-pass case (CKI Backport Bot) [RHEL-88328] {CVE-2025-21961}
  - vmxnet3: unregister xdp rxq info in the reset path (CKI Backport Bot) [RHEL-92471]
  - md: fix mddev uaf while iterating all_mddevs list (CKI Backport Bot) [RHEL-89062] {CVE-2025-22126}
  - nvme: print firmware bug note for non-unique identifiers (Bryan Gurney) [RHEL-91163]
  - nvme-pci: add BOGUS_NID quirk for Samsung PM1733 (Bryan Gurney) [RHEL-91163]
  - media: v4l2-mediabus: Drop V4L2_MBUS_CSI2_CONTINUOUS_CLOCK flag (Kate Hsuan) [RHEL-90323]
  - media: v4l2-mediabus: Drop legacy V4L2_MBUS_CSI2_CHANNEL_* flags (Kate Hsuan) [RHEL-90323]
  - media: v4l2-mediabus: Use structures to describe bus configuration (Kate Hsuan) [RHEL-90323]
  - media: v4l2-fwnode: Move bus config structure to v4l2_mediabus.h (Kate Hsuan) [RHEL-90323]
  - sched/fair: Fix CPU bandwidth limit bypass during CPU hotplug (Phil Auld) [RHEL-86302]
  - smb: client: fix UAF in decryption with multichannel (CKI Backport Bot) [RHEL-94460] {CVE-2025-37750}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.23.1.el9_6]
changelog:
  - ext4: ignore xattrs past end (CKI Backport Bot) [RHEL-94248] {CVE-2025-37738}
  - ibmvnic: Use kernel helpers for hex dumps (CKI Backport Bot) [RHEL-89019] {CVE-2025-22104}
  - ice: Avoid setting default Rx VSI twice in switchdev setup (Petr Oros) [RHEL-88310] {CVE-2025-21883}
  - ice: Fix deinitializing VF in error path (CKI Backport Bot) [RHEL-88310] {CVE-2025-21883}
  - ice: add E830 HW VF mailbox message limit support (CKI Backport Bot) [RHEL-88310] {CVE-2025-21883}
  - sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CKI Backport Bot) [RHEL-88322] {CVE-2025-21919}
  - redhat: configs: Enable CX231XX driver (Kate Hsuan) [RHEL-89730]
  - media: usb: usbtv: Stop direct calls to queue num_buffers field (Kate Hsuan) [RHEL-89730]
  - media: saa6752hs: Don't set format in sub-device state (Kate Hsuan) [RHEL-89730]
  - media: i2c: Use accessors for pad config 'try_*' fields (Kate Hsuan) [RHEL-89730]
  - ext4: fix off-by-one error in do_split (CKI Backport Bot) [RHEL-93629] {CVE-2025-23150}


author: Wen Liang <wenliang@redhat.com> - 1:1.52.0-4
changelog:
  - ovs: allow reapplying ovs-bridge and ovs-port properties (RHEL-87595)
  - core: ovs: fix NULL pointer dereference in ovsdb read timeout callback (RHEL-87347)


author: Jan Macku <jamacku@redhat.com> - 20210202-11.1
changelog:
  - Fix CVE-2025-47268 iputils: Signed Integer Overflow in Timestamp Multiplication in iputils ping (RHEL-94335)


author: Denys Vlasenko <dvlasenk@redhat.com> - 20250513-151.1
changelog:
  - Update linux-firmware to latest upstream (RHEL-91077)
    Changes since the last update are noted on items below, copied from
    the git changelog of upstream linux-firmware repository.
  - intel_vpu: Update NPU firmware
  - intel: avs: Update topology file for Digital Microphone Array
  - amdgpu: updates for dcn 3.20 and dcn 4.01 firmware to 0.1.10.0
  - linux-firmware: Amphion: Update vpu firmware
  - amd_pmf: Update AMD PMF TA Firmware to v3.1
  - amdgpu: update dcn 4.01 firmware to 0.1.8.0
  - qcom: Add link for SM8350 GPU firmware
  - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops
  - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops
  - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops
  - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops
  - linux-firmware: update firmware for MT7925 WiFi device
  - mediatek MT7925: update bluetooth firmware to 20250425073330
  - rtw89: 8852c: add tables for dynamic antenna TXPWR
  - rtw89: 8922a: update fw to v0.35.71.0
  - brcm: Add NVRAM file for Radxa Rock Pi X mini PC
  - i915: Update Xe3LPD DMC to v2.23
  - rtl_bt: Update RTL8852B BT USB FW to 0x098B_154B
  - ath11k: WCN6855 hw2.0: update board-2.bin
  - ath11k: IPQ5018 hw1.0: update to WLAN.HK.2.6.0.1-01300-QCAHKSWPL_SILICONZ-1
  - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
  - ath12k: QCN9274 hw2.0: update board-2.bin
  - qcom: vpu: update video firmware binary for SA8775p
  - iwlwifi: add Bz/gl FW for core95-82 release
  - iwlwifi: update ty/So/Ma firmwares for core95-82 release
  - iwlwifi: update cc/Qu/QuZ firmwares for core95-82 release
  - iwlwifi: add Bz-hr FW for core93-123 release
  - qcom: add QUPv3 firmware for QCS9100 platform
  - ASoC: tas2781: Swap channel for SPI projects.
  - bmi260: Add BMI260 IMU initial configuration data file
  - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x1881_BA06
  - rtw89: 8922a: update element RF TXPWR to R40
  - rtw89: 8852c: update element RF TXPWR to R78
  - rtw89: 8852c: add fw v0.27.125.0 with format version 2
  - Revert "rtw89: 8852c: update fw to v0.27.125.0"
  - qcom: vpu: add video firmware binary for qcm6490
  - contrib: process_linux_firmware: set user agent
  - amdgpu: update vcn 4.0.5 firmware
  - amdgpu: update psp 14.0.0 firmware
  - amdgpu: update vcn 4.0.2 firmware
  - amdgpu: update psp 13.0.4 firmware
  - amdgpu: update gc 11.0.1 firmware
  - amdgpu: update navy flounder firmware
  - amdgpu: update psp 14.0.4 firmware
  - amdgpu: update gc 11.5.2 firmware
  - amdgpu: update vcn 5.0.0 firmware
  - amdgpu: update smu 14.0.3 firmware
  - amdgpu: update psp 14.0.3 firmware
  - amdgpu: update gc 12.0.1 firmware
  - amdgpu: update sienna cichlid firmware
  - amdgpu: update yellow carp firmware
  - amdgpu: update smu 14.0.2 firmware
  - amdgpu: update psp 14.0.2 firmware
  - amdgpu: update gc 12.0.0 firmware
  - amdgpu: update vega20 firmware
  - amdgpu: update navi14 firmware
  - amdgpu: update vega12 firmware
  - amdgpu: update vcn 4.0.4 firmware
  - amdgpu: update smu 13.0.7 firmware
  - amdgpu: update psp 13.0.7 firmware
  - amdgpu: update gc 11.0.2 firmware
  - amdgpu: update vega10 firmware
  - amdgpu: update psp 13.0.5 firmware
  - amdgpu: update navi12 firmware
  - amdgpu: update psp 13.0.10 firmware
  - amdgpu: update gc 11.0.3 firmware
  - amdgpu: update navi10 firmware
  - amdgpu: update vangogh firmware
  - amdgpu: update picasso firmware
  - amdgpu: update vcn 4.0.0 firmware
  - amdgpu: update psp 13.0.0 firmware
  - amdgpu: update gc 11.0.0 firmware
  - amdgpu: update psp 13.0.14 firmware
  - amdgpu: update gc 9.4.4 firmware
  - amdgpu: update arcturus firmware
  - amdgpu: update psp 13.0.6 firmware
  - amdgpu: update gc 9.4.3 firmware
  - amdgpu: update beige goby firmware
  - amdgpu: update psp 13.0.8 firmware
  - amdgpu: update psp 14.0.1 firmware
  - amdgpu: update gc 11.5.1 firmware
  - amdgpu: update psp 13.0.11 firmware
  - amdgpu: update gc 11.0.4 firmware
  - amdgpu: update dimgrey cavefish firmware
  - amdgpu: update aldebaran firmware
  - amdgpu: update dcn 4.01 frmware to 0.1.6.0
  - intel: ish: Update license file for ISH
  - intel: avs: Update topology file for I2S Analog Devices 4567
  - intel: avs: Update topology file for I2S Realtek 5663
  - intel: avs: Update topology file for I2S Realtek 5640
  - intel: avs: Update topology file for I2S Realtek 5514
  - intel: avs: Update topology file for I2S Realtek 298
  - intel: avs: Update topology file for I2S Realtek 286
  - intel: avs: Update topology file for I2S Realtek 274
  - intel: avs: Update topology file for I2S Nuvoton 8825
  - intel: avs: Update topology file for I2S Maxim 98927
  - intel: avs: Update topology file for I2S Maxim 98373
  - intel: avs: Update topology file for I2S Maxim 98357a
  - intel: avs: Update topology file for HDAudio codecs
  - intel: avs: Update topology file for HDMI codecs
  - intel: avs: Update topology file for Digital Microphone Array
  - intel: avs: Update topology file for I2S Dialog 7219
  - xe: Update GUC to v70.44.1 for BMG and LNL
  - i915: Update GUC to v70.44.1 for i915 platforms
  - qcom:x1e80100: Iris Support for Lenovo T14s G6 Qualcomm platform
  - qcom:x1e80100: Support for Lenovo Yoga Slim 7 Snapdragon platform
  - Mellanox: Add new mlxsw_spectrum firmware xx.2014.4012
  - linux-firmware: add firmware for Aeonsemi AS21x1x 1G/2.5G/5G/10G Ethernet Phy
  - QCA: Add 8 bluetooth nvm files for WCN785x btusb
  - QCA: Update WCN785x btusb firmware to 2.0.0-00790-3
  - qcom: update firmware binary for SM8250
  - mediatek: Add new mt8195 SOF firmware
  - mediatek: Add new mt8188 SOF firmware
  - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x17E9_16ED
  - Revert "rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6"
  - intel_vpu: Update NPU firmware
  - cirrus: cs35l56: Correct filenames of SSID 103c8e1b and 103c8e1c
  - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6
  - amdgpu: update dcn 3.5 and dcn 3.5.1 firmware to 9.0.27.0
  - amdgpu: update dcn 3.1.4 firmware to 8.0.78.0
  - amdgpu: update dcn 4.01 firmware to 0.1.3.0
  - amdgpu: update dcn 3.5 firmware to 0.1.0.0
  - cirrus: cs35l41: Add Firmware for various HP Laptops using CS35L41 HDA
  - cirrus: Add cs35l56 firmware symlinks for Asus UM5606KA
  - qcom: Add DSP firmware for QCS8300 platform
  - mediatek: Add MT8188 SCP firmware
  - copy-firmware: fail gracefully if moreutils parallel is installed
  - copy-firmware: make script smarter about bad parameters
  - copy-firmware: add usage help text
  - linux-firmware: Update firmware file for Intel BlazarI core
  - qcom: Add Audio firmware for Lenovo Slim 7x
  - qcom: Add Audio firmware for Lenovo T14s
  - amdgpu: DMCUB updates for various ASICs
  Resolves: RHEL-91077


author: Jiri Hnidek <jhnidek@redhat.com> 1.29.45.1-1
changelog:
  - fix: Handle improperly closed connections (mhorky@redhat.com)
  - ci: use the right distro for coverage reporting (ptoscano@redhat.com)


author: Denys Vlasenko <dvlasenk@redhat.com> - 4:20250211-1.20250512.1
changelog:
  - Add a caveat to provide ability to persistently disable SPR-EE updates
    beyond 0x2b0005c0 on systems where absence of latency spikes
    is more important than lack of the latest CVE mitigations.
  - Update Intel CPU microcode to microcode-20250512 release, addresses
    CVE-2024-28956, CVE-2025-20103, CVE-2025-20054, CVE-2024-43420,
    CVE-2025-20623, CVE-2024-45332, CVE-2025-24495, CVE-2025-20012
    - Addition of 06-8f-04/0x10 microcode (in
      intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2c0003f7;
    - Addition of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639;
    - Addition of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
      intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2c0003f7;
    - Addition of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639;
    - Addition of 06-8f-06/0x10 microcode (in
      intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2c0003f7;
    - Addition of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639;
    - Addition of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639;
    - Addition of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
      intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2c0003f7;
    - Addition of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639;
    - Addition of 06-ad-01/0x20 (GNR-AP/SP H0) microcode at revision
      0xa0000d1;
    - Addition of 06-ad-01/0x95 (GNR-AP/SP B0) microcode at revision
      0x10003a2;
    - Addition of 06-b5-00/0x80 (ARL-U A1) microcode at revision 0xa;
    - Addition of 06-bd-01/0x80 (LNL B0) microcode at revision 0x11f;
    - Addition of 06-c5-02/0x82 (ARL-H A1) microcode at revision 0x118;
    - Addition of 06-c6-02/0x82 (ARL-HX 8P/S B0) microcode (in
      intel-ucode/06-c5-02) at revision 0x118;
    - Addition of 06-c6-04/0x82 microcode (in intel-ucode/06-c5-02) at
      revision 0x118;
    - Addition of 06-ca-02/0x82 microcode (in intel-ucode/06-c5-02) at
      revision 0x118;
    - Addition of 06-c5-02/0x82 (ARL-H A1) microcode (in
      intel-ucode/06-c6-02) at revision 0x118;
    - Addition of 06-c6-02/0x82 (ARL-HX 8P/S B0) microcode at revision
      0x118;
    - Addition of 06-c6-04/0x82 microcode (in intel-ucode/06-c6-02) at
      revision 0x118;
    - Addition of 06-ca-02/0x82 microcode (in intel-ucode/06-c6-02) at
      revision 0x118;
    - Update of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode (in
      intel-06-8c-01/intel-ucode/06-8c-01) from revision 0xb8 up to 0xbc;
    - Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0)
      microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0c) from
      revision 0xfc up to 0x100;
    - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0d) from revision 0x102 up
      to 0x104;
    - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision
      0x5003707 up to 0x5003901;
    - Update of 06-55-0b/0xbf (CPX-SP A1) microcode from revision 0x7002904
      up to 0x7002b01;
    - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd0003f5
      up to 0xd000404;
    - Update of 06-6c-01/0x10 (ICL-D B0) microcode from revision 0x10002c0
      up to 0x10002d0;
    - Update of 06-7a-08/0x01 (GLK-R R0) microcode from revision 0x24 up
      to 0x26;
    - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0xc6
      up to 0xca;
    - Update of 06-8c-02/0xc2 (TGL-R C0) microcode from revision 0x38 up
      to 0x3c;
    - Update of 06-8d-01/0xc2 (TGL-H R0) microcode from revision 0x52 up
      to 0x56;
    - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-05) from
      revision 0x2c0003e0 up to 0x2c0003f7;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode from revision
      0x2c0003e0 up to 0x2c0003f7;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode from revision 0x2b000620
      up to 0x2b000639;
    - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-05) from
      revision 0x2c0003e0 up to 0x2c0003f7;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
      intel-ucode/06-8f-05) from revision 0x2c0003e0 up to 0x2c0003f7;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-06) from
      revision 0x2c0003e0 up to 0x2c0003f7;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
      intel-ucode/06-8f-06) from revision 0x2c0003e0 up to 0x2c0003f7;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-8f-06/0x10 microcode from revision 0x2c0003e0 up to
      0x2c0003f7;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode from revision 0x2b000620
      up to 0x2b000639;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
      intel-ucode/06-8f-06) from revision 0x2c0003e0 up to 0x2c0003f7;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode from revision
      0x2b000620 up to 0x2b000639;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode from revision
      0x38 up to 0x3a;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-97-02) from revision 0x38 up to 0x3a;
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-02)
      from revision 0x38 up to 0x3a;
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-02)
      from revision 0x38 up to 0x3a;
    - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-97-02) from
      revision 0x38 up to 0x3a;
    - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-97-02) from
      revision 0x38 up to 0x3a;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-97-05) from revision 0x38 up to 0x3a;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode from revision 0x38
      up to 0x3a;
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-05)
      from revision 0x38 up to 0x3a;
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-05)
      from revision 0x38 up to 0x3a;
    - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-97-05) from
      revision 0x38 up to 0x3a;
    - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-97-05) from
      revision 0x38 up to 0x3a;
    - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode from revision
      0x436 up to 0x437;
    - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in
      intel-ucode/06-9a-03) from revision 0x436 up to 0x437;
    - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in
      intel-ucode/06-9a-04) from revision 0x436 up to 0x437;
    - Update of 06-9a-04/0x40 (AZB A0) microcode from revision 0x9 up
      to 0xa;
    - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode from revision 0x436
      up to 0x437;
    - Update of 06-a5-02/0x20 (CML-H R1) microcode from revision 0xfc up
      to 0x100;
    - Update of 06-a5-03/0x22 (CML-S 6+2 G1) microcode from revision 0xfc
      up to 0x100;
    - Update of 06-a5-05/0x22 (CML-S 10+2 Q0) microcode from revision 0xfc
      up to 0x100;
    - Update of 06-a6-00/0x80 (CML-U 6+2 A0) microcode from revision 0xfe
      up to 0x102;
    - Update of 06-a6-01/0x80 (CML-U 6+2 v2 K1) microcode from revision
      0xfc up to 0x100;
    - Update of 06-a7-01/0x02 (RKL-S B0) microcode from revision 0x63 up
      to 0x64;
    - Update of 06-aa-04/0xe6 (MTL-H/U C0) microcode from revision 0x20
      up to 0x24;
    - Update of 06-af-03/0x01 (SRF-SP C0) microcode from revision 0x3000330
      up to 0x3000341;
    - Update of 06-b7-01/0x32 (RPL-S B0) microcode from revision 0x12c up
      to 0x12f;
    - Update of 06-b7-04/0x32 microcode (in intel-ucode/06-b7-01) from
      revision 0x12c up to 0x12f;
    - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode from revision
      0x4124 up to 0x4128;
    - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in
      intel-ucode/06-ba-02) from revision 0x4124 up to 0x4128;
    - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-02) from
      revision 0x4124 up to 0x4128;
    - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in
      intel-ucode/06-ba-03) from revision 0x4124 up to 0x4128;
    - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode from revision 0x4124
      up to 0x4128;
    - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-03) from
      revision 0x4124 up to 0x4128;
    - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in
      intel-ucode/06-ba-08) from revision 0x4124 up to 0x4128;
    - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in
      intel-ucode/06-ba-08) from revision 0x4124 up to 0x4128;
    - Update of 06-ba-08/0xe0 microcode from revision 0x4124 up to 0x4128;
    - Update of 06-be-00/0x19 (ADL-N A0) microcode from revision 0x1c up
      to 0x1d;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-bf-02) from revision 0x38 up to 0x3a;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-bf-02) from revision 0x38 up to 0x3a;
    - Update of 06-bf-02/0x07 (ADL C0) microcode from revision 0x38 up
      to 0x3a;
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-bf-02)
      from revision 0x38 up to 0x3a;
    - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-bf-02) from
      revision 0x38 up to 0x3a;
    - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-bf-02) from
      revision 0x38 up to 0x3a;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-bf-05) from revision 0x38 up to 0x3a;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-bf-05) from revision 0x38 up to 0x3a;
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-bf-05)
      from revision 0x38 up to 0x3a;
    - Update of 06-bf-05/0x07 (ADL C0) microcode from revision 0x38 up
      to 0x3a;
    - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-bf-05) from
      revision 0x38 up to 0x3a;
    - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-bf-05) from
      revision 0x38 up to 0x3a;
    - Update of 06-cf-01/0x87 (EMR-SP A0) microcode from revision 0x21000291
      up to 0x210002a9;
    - Update of 06-cf-02/0x87 (EMR-SP A1) microcode (in
      intel-ucode/06-cf-01) from revision 0x21000291 up to 0x210002a9;
    - Update of 06-cf-01/0x87 (EMR-SP A0) microcode (in
      intel-ucode/06-cf-02) from revision 0x21000291 up to 0x210002a9;
    - Update of 06-cf-02/0x87 (EMR-SP A1) microcode from revision 0x21000291
      up to 0x210002a9.


author: Benjamin Marzinski <bmarzins@redhat.com> - 0.8.7-35.1
changelog:
  - Add 0128-multipath-tools-move-DEFAULT_SOCKET-definition-into-.patch
  - Add 0129-multipath-tools-add-helper-mpath_fill_sockaddr__.patch
  - Add 0130-libmpathutil-add-support-for-Unix-pathname-sockets.patch
  - Add 0131-libmpathutil-move-systemd_listen_fds-support-into-mu.patch
  - Add 0132-multipathd-move-uxsock_trigger-to-uxlsnr.c.patch
  - Add 0133-multipathd-uxlsnr-use-symbolic-values-for-pollfd-ind.patch
  - Add 0134-multipathd-make-uxsock_listen-take-a-pointer-to-fd.patch
  - Add 0135-multipathd-allow-receiving-two-socket-fds-from-syste.patch
  - Add 0136-multipathd-listen-on-pathname-and-abstract-socket-by.patch
  - Add 0137-libmpathcmd-try-both-abstract-and-pathname-sockets.patch
  - Add 0138-libmpathcmd-honor-MULTIPATH_SOCKET_NAME-environment-.patch
  - Add 0139-multipathd-honor-MULTIPATH_SOCKET_NAME-environment-v.patch
    * Fixes RHEL-80352 ("RFE: Enable multipathd to communicate with a
      process in another network namespace")
  - Resolves: RHEL-80352


author: Julien Rische <jrische@redhat.com> - 1.21.1-9
changelog:
  - Do not block HMAC-MD4/5 in FIPS mode
    Resolves: RHEL-88704
  - Don't issue RC4 session keys by default (CVE-2025-3576)
    Resolves: RHEL-88048
  - Add PKINIT paChecksum2 from MS-PKCA v20230920
    Resolves: RHEL-82647


author: Jan Jansky <jjansky@redhat.com> = 4.9.1-1
changelog:
  - Update to 4.9.1 in RHEL 9
    Resolves: RHEL-86668
    Resolves: RHEL-86644
    Resolves: RHEL-86647
    Resolves: RHEL-86646


author: Jan Jansky <jjansky@redhat.com> = 4.9.1-2
changelog:
  - Update to 4.9.1-2 in RHEL 9
    Resolves: RHEL-86668
    Resolves: RHEL-86644
    Resolves: RHEL-86647
    Resolves: RHEL-86646


author: Patrick Talbert <ptalbert@redhat.com> [5.14.0-570.24.1.el9_6]
changelog:
  - Squashfs: fix handling and sanity checking of xattr_ids count (CKI Backport Bot) [RHEL-93465] {CVE-2023-52933}
  - net/mlx5: Fill out devlink dev info only for PFs (CKI Backport Bot) [RHEL-93770]
  - dm mpath: replace spin_lock_irqsave with spin_lock_irq (Benjamin Marzinski) [RHEL-89487]
  - dm-mpath: Don't grab work_mutex while probing paths (Benjamin Marzinski) [RHEL-89487]
  - dm mpath: Interface for explicit probing of active paths (Benjamin Marzinski) [RHEL-89487]
  - dm: Allow .prepare_ioctl to handle ioctls directly (Benjamin Marzinski) [RHEL-89487]
  - NFS: O_DIRECT writes must check and adjust the file length (Benjamin Coddington) [RHEL-96060]
  - pnfs/flexfiles: retry getting layout segment for reads (Benjamin Coddington) [RHEL-96060]
  - NFS/pnfs: Fix a live lock between recalled layouts and layoutget (Benjamin Coddington) [RHEL-96060]
  - x86/tsc: Use topology_max_packages() to get package number (David Arcari) [RHEL-96886]
  - scsi: storvsc: Explicitly set max_segment_size to UINT_MAX (Ewan D. Milne) [RHEL-97519]


author: Charalampos Stratakis <cstratak@redhat.com> - 3.9.21-2.1
changelog:
  - Security fixes for CVE-2025-4517, CVE-2025-4330, CVE-2025-4138, CVE-2024-12718, CVE-2025-4435
  Resolves: RHEL-98053, RHEL-98025, RHEL-98243, RHEL-98195, RHEL-98219


