# changelog

author: Al Stone <ahs3@fedoraproject.org> - 20240322-1
changelog:
  - Update source tree to 20240322 version from upstream.  NB: this update
    is done in conjunction with removing s390x support due to the large
    number of patches that are now rendered obsolete.  Closes BZ#2138250.
  - Note, too, that the upstream version of the tarball is missing two
    commits and has the wrong name; discussed this with upstream and
    included a patch with the two commits to correct this, and renamed
    the tarballs to try to maintain consistency. So, upstream is actually
    named version 20240321, but it should be 20240322 according to their
    own git tree (see tag G20240322 on github).
  - Removed executable bit from all the upstream source files
  - Remove big-endian support, aka s390x.  Closes BZ#2298855.
  - Remove several 32-bit only patches that are also obsolete since they
    are for unsupported architectures (thanks to pbonzini and PR#5).
  - Remove PIE patches since that is currently the default (again, thanks
    to pbonzini and PR#5)
  - Resolves: RHEL-66144


author: Andreas Schneider <asn@redhat.com> - 1.1.7-1
changelog:
  - Update to version 1.1.7
    * Update ignore list for source tarball generation
    * Added new assert macros to compare 2 double given an epsilon
    * Added meson build system
    * Added header with version to TAP13 output
    * Fixed issues with MSVC
    * Fixed TAP output for skipped tests
    * Fixed issue with fail_msg
    * CMake generated configs for find_package(cmocka)
    * Documentation improvements


author: Ales Nezbeda <anezbeda@redhat.com> - 0.8.8-49
changelog:
  - Fix SPDX license tag based on further research
  - https://gitlab.com/fedora/legal/fedora-license-data/-/issues/396#note_1976038980
  - Related: RHEL-37885


author: Than Ngo <than@redhat.com> - 2:1.12.0-3
changelog:
  - Fix Non-reproducible file names in doxygen output
  - Fix broken markdown links to anchors
  Related: RHEL-58045


author: Parag Nemade <pnemade AT redhat DOT com> - 20230101-14
changelog:
  - Resolves: RHEL-138159
    CVE-2025-15279 GUtils BMP File Parsing Heap-based Buffer Overflow
  - Resolves: RHEL-138144
    CVE-2025-15275 SFD File Parsing Heap-based Buffer Overflow
  - Resolves: RHEL-138126
    CVE-2025-15269 SFD File Parsing Use-After-Free


author: Florian Weimer <fweimer@redhat.com> - 2.39-120
changelog:
  - Sync with upstream branch release/2.39/master (RHEL-151554)
  - Upstream commit: 0dc95ae10929aba1cc660e97cfc94903c2568efa
  - resolv: Check hostname for validity (CVE-2026-4438)
  - resolv: Count records correctly (CVE-2026-4437)
  - iconvdata: Fix invalid pointer arithmetic in ANSI_X3.110 module


author: Eduard Abdullin <eabdullin@almalinux.org> - 2.39-124.alma.1
changelog:
  - Overwrite target for x86_64_v2
  - Update patch-git.lua to handle AlmaLinux branches correctly
  - Add support for AlmaLinux import UBI format


author: Takao Fujiwara <tfujiwar@redhat.com> - 2018.1-17
changelog:
  - Resolve RHELPLAN-170235 Fix OpenScanHub report
  - Fix deprecated g_spawn_check_exit_status with -Wdeprecated-declarations
  - Fix uninitialized n_failed with -Wanalyzer-use-of-uninitialized-value
  - Fix to check return value of g_setenv() with CWE-252


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.8.0.2-0.1.ea
changelog:
  - Update to jdk-21.0.8+2 (EA)
  - Update release notes to 21.0.8+2
  - Sync the copy of the portable specfile with the latest update
  - Add timezone data update check to openjdk_news.sh
  - Add duplicate check to openjdk_news.sh
  - Exit if no fixes are obtained rather than try to run filters in openjdk_news.sh
  - Related: RHEL-101803
  - Resolves: RHEL-103211


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.8.0.8-0.1.ea
changelog:
  - Update to jdk-21.0.8+8 (EA)
  - Update release notes to 21.0.8+8
  - Sync the copy of the portable specfile with the latest update
  - Resolves: RHEL-101803


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.8.0.9-1
changelog:
  - Update to jdk-21.0.8+9 (GA)
  - Update release notes to 21.0.8+9
  - Switch to GA mode
  - Sync the copy of the portable specfile with the latest update
  - ** This tarball is embargoed until 2025-07-15 @ 1pm PT. **
  - Resolves: RHEL-102295


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.9.0.10-1
changelog:
  - Update to jdk-21.0.9+10 (GA)
  - Update release notes to 21.0.9+10
  - Bump harfbuzz version to 11.2.0 following JDK-8355528
  - Add NEWS corrections from Thomas
  - Use double spacing consistently in notes for this release
  - Correct 11u release reference to corresponding 21u release as pointed out by Kieran
  - Sync the copy of the portable specfile with the latest update
  - ** This tarball is embargoed until 2025-10-21 @ 1pm PT. **
  - Resolves: RHEL-118771
  - Resolves: RHEL-119468


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.9.0.10-2
changelog:
  - Bump rpmrelease for CentOS build
  - Add scripts to handle tagging of portable-based RPMs
  - Related: RHEL-118771
  - Related: RHEL-119468


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.10.0.7-1
changelog:
  - Update to jdk-21.0.10+7 (GA)
  - Update release notes to 21.0.10+7
  - Bump libpng version to 1.6.51 following JDK-8372534
  - Update FIPS patch to include nss.fips.cfg that grants CKA_ENCRYPT
  - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh
  - Sync the copy of the portable specfile with the latest update
  - Resolves: RHEL-142857
  - Resolves: RHEL-139565
  - Resolves: RHEL-131428
  - Resolves: RHEL-131441
  - Resolves: RHEL-142861
  - Resolves: RHEL-142815
  - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. **


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.10.0.7-2
changelog:
  - Bump rpmrelease for CentOS build
  - Related: RHEL-142857
  - Related: RHEL-139565
  - Related: RHEL-131428
  - Related: RHEL-131441
  - Related: RHEL-142861
  - Related: RHEL-142815


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.11.0.10-1
changelog:
  - Update to jdk-21.0.11+10 (GA)
  - Update release notes to 21.0.11+10
  - Update FIPS patch to feef2dc3ca7 version synced with 21.0.11+9 and adapted to JDK-8244336
  - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158
  - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078
  - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047
  - Bump zlib version to 1.3.2 following JDK-8378631
  - Add JDK-8375294 EOPNOTSUPP patch ahead of 21.0.13
  - Sync the copy of the portable specfile with the latest update
  - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. **
  - Resolves: RHEL-169611
  - Resolves: RHEL-133215
  - Resolves: RHEL-146648
  - Resolves: RHEL-148326
  - Resolves: RHEL-148828
  - Resolves: RHEL-157090
  - Resolves: RHEL-161216
  - Resolves: RHEL-161332
  - Resolves: RHEL-169614


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:25.0.1.0.8-5
changelog:
  - Incorporate new FIPS patch for 25u
  - Drop static libjvm.a following adjusted build target for portable build
  - Remove redundant (and now outdated) build targets, jdkimage and static_libs_image
  - Pass ourflags and ourldflags into the nssadapter build using CFLAGS & LDFLAGS
  - Patch the nssadapter build to recognise LDFLAGS
  - Remove OpenJDK compiler flag filters and use build_{c,ld}flags directly
  - Resolves: RHEL-133733
  - Resolves: RHEL-133735
  - Resolves: RHEL-133763


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:25.0.1.0.8-6
changelog:
  - Sync the copy of the portable specfile with the latest update
  - Related: RHEL-133733
  - Related: RHEL-133735


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:25.0.2.0.10-1
changelog:
  - Update to jdk-25.0.2+10 (GA)
  - Update release notes to 25.0.2+10
  - Add JDK-8372534 libpng 1.6.51 ahead of 25.0.3
  - Bump libpng version to 1.6.51 following JDK-8372534
  - Bump ID of NSS adapter patch so we can stay in sync with portable on the libpng patch
  - Test for java.security's existence in create-redhat-properties-files.bash
  - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh
  - Sync the copy of the portable specfile with the latest update
  - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. **
  - Resolves: RHEL-139579
  - Resolves: RHEL-131430
  - Resolves: RHEL-131443
  - Resolves: RHEL-142855
  - Resolves: RHEL-142799


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:25.0.2.0.10-2
changelog:
  - Bump rpmrelease for CentOS build
  - Related: RHEL-139579
  - Related: RHEL-131430
  - Related: RHEL-131443
  - Related: RHEL-142855
  - Related: RHEL-142799


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:25.0.2.0.10-3
changelog:
  - Update FIPS patch to e55ada9353e to include the fix for the too restrictive provider lockdown
  - Fix FIPS issue list to represent the new 25u version
  - Add JDK-8375063 libpng 1.6.54 ahead of 25.0.3
  - Add JDK-8375057 harfbuzz 12.3.2 ahead of 25.0.3
  - Add JDK-8377526 libpng 1.6.55 ahead of 25.0.3
  - Bump libpng version to 1.6.55 following JDK-8375063 & JDK-8377526
  - Bump harfbuzz version to 12.3.2 following JDK-8375057
  - Bump nssadapter version to bring in shared PKCS11 session fix
  - Drop LDFLAGS nssadapter patch which is now upstream in 0.1.1
  - Resolves: RHEL-155000
  - Resolves: RHEL-146649
  - Resolves: RHEL-148327
  - Resolves: RHEL-148830
  - Resolves: RHEL-155044


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:25.0.2.0.10-3
changelog:
  - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm
  - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1
  - Resolves: RHEL-150976


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:25.0.2.0.10-4
changelog:
  - Add tagging scripts with signature checks and gating handling
  - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3.
  - Add gating scripts to simplify obtaining results and waiving issues
  - Sync the copy of the portable specfile with the latest update
  - Resolves: RHEL-155327
  - Resolves: RHEL-155337
  - Resolves: RHEL-155339
  - Related: RHEL-155000
  - Related: RHEL-146649
  - Related: RHEL-148327
  - Related: RHEL-148830


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:25.0.3.0.9-1
changelog:
  - Update to jdk-25.0.3+9 (GA)
  - Update release notes to 25.0.3+9
  - Update FIPS patch to 57722aab802 version synced with 25.0.3+8
  - Drop local libpng patches now JDK-8372534, JDK-8375063 & JDK-8377526 are included upstream
  - Drop local HarfBuzz patch now JDK-8375057 is included upstream
  - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158
  - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078
  - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047
  - Bump zlib version to 1.3.2 following JDK-8378631
  - Bump tzdata version to 2026a following JDK-8379035
  - Add JDK-8375294 EOPNOTSUPP patch ahead of 25.0.4
  - Sync the copy of the portable specfile with the latest update
  - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. **
  - Resolves: RHEL-169620
  - Resolves: RHEL-157091
  - Resolves: RHEL-161217
  - Resolves: RHEL-161333
  - Resolves: RHEL-169613


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 1.26-1
changelog:
  - New upstream release
  - Improve TX performance and use less CPU
  - minor other improvements
  - Build system update


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 1.27-1
changelog:
  - New upstream release
  - Fix potential startup race condition (corosync use case)
  - Fix crypto config check
  - Minor API cleanup
  - Test suite fixes


author: Dodji Seketeli <dodji@redhat.com> - 2.5-1
changelog:
  - Update to upstream 2.5 tarball
  - Drop patches (as they are now upstream):
    0001-Bug-31045-Don-t-try-setting-translation-unit-for-uni.patch
    0002-suppression-Add-has_strict_flexible_array_data_membe.patch
  - Enable abidb
  - Add BuildRequires: python3-devel
  - Add libabigail.so.4 and libabigail.so.4.0.0 to the RPM


author: Dodji Seketeli <dodji@redhat.com> - 2.6-1
changelog:
  - Update to upstream 2.6 tarball
  - Update to changing SONAME (libabigail.so.5.0.0)
  - Add BuildRequires xxhash-devel


author: Dodji Seketeli <dodji@redhat.com> - 2.8-1
changelog:
  - Update to upstream 2.8 tarball
  - Remove 0001-Fix-fedabipkgdiff-configure-check-for-Python-3.12.patch
    that is applied upstream.
  - Update to changing SONAME (libabigail.so.7.0.0)
  - Add xxhash-devel as BuildRequires and inlined-xxhash to avoid
    depending on it at runtime


author: RHEL Packaging Agent <jotnar@redhat.com> - 2.9-1
changelog:
  - Rebase to upstream 2.9 tarball
  - Update to changing SONAME (libabigail.so.8.0.0)
  - Simplify %check section to run both test targets in single invocation
  - Resolves: RHEL-121667


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.8.1.el10_2]
changelog:
  - ice: drop udp_tunnel_get_rx_info() call from ndo_open() (Mohammad Heib) [RHEL-165081]
  - i40e: drop udp_tunnel_get_rx_info() call from i40e_open() (Mohammad Heib) [RHEL-165081]
  - ALSA: hda/tas2781: Ignore reset check for SPI device (Jaroslav Kysela) [RHEL-157285]
  - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158990]
  - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159227] {CVE-2025-68741}
  - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Vinay Mulugund) [RHEL-155205]
  - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-158206]
  - net: openvswitch: Avoid releasing netdev before teardown completes (Toke Høiland-Jørgensen) [RHEL-157946]
  - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155971]
  - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155971]
  - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155971]
  - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155971]
  - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155971]
  - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155971]
  - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155971]
  - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155971]
  - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150456] {CVE-2025-39766}
  - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150456] {CVE-2025-39766}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.10.1.el10_2]
changelog:
  - ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717]
  - ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717]
  - ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717]
  - ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717]
  - ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717]
  - ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717]
  - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.11.1.el10_2]
changelog:
  - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402}
  - KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401}
  - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.12.1.el10_2]
changelog:
  - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354]
  - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354]
  - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354]
  - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354]
  - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354]
  - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354]
  - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354]
  - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724}
  - net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.13.1.el10_2]
changelog:
  - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531]
  - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408}


author: Patrick Talbert <ptalbert@redhat.com> [6.12.0-211.14.1.el10_2]
changelog:
  - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213]
  - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213]
  - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213]
  - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213]
  - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
  - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060}
  - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213]
  - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677}
  - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
  - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213]


author: Patrick Talbert <ptalbert@redhat.com> [6.12.0-211.15.1.el10_2]
changelog:
  - xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.16.1.el10_2]
changelog:
  - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
  - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
  - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333}
  - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128}
  - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607}


author: Andrew Lukoshko <alukoshko@almalinux.org> - 6.12.0-211.16.1
changelog:
  - Recreate RHEL 6.12.0-211.16.1 from CentOS Stream 10 and upstream stable backports (1106-1161)
  - Drop 211.7.x security-ahead patches superseded by the RHEL backports (1100-1104: crypto authencesn/algif, xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace)
  - Keep the smb cifs.spnego ahead-fix (1105)
  - RHEL changelog for 211.8.1..211.16.1 follows:


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.17.1.el10_2]
changelog:
  - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625]
  - redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov)
  - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303}
  - dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205}
  - dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205}
  - mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375}
  - fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617]
  - anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617]
  - pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617]
  - anon_inode: explicitly block ->setattr() (Rafael Aquini) [RHEL-171617]
  - pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617]
  - anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617]
  - ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331]
  - ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331]
  - net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809]
  - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190}
  - netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116}
  - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110}
  - redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944]
  - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051}
  - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027}
  - io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006}
  - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434]
  - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434]
  - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434]
  - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434]
  - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434]
  - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637]
  - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637]
  - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685}
  - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684}
  - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180]
  - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786]
  - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786]
  - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455}
  - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183}
  - can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645}
  - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.18.1.el10_2]
changelog:
  - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
  - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
  - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023}
  - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020}
  - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872]


author: Andrew Lukoshko <alukoshko@almalinux.org> - 6.12.0-211.18.1
changelog:
  - Recreate RHEL 6.12.0-211.18.1 from CentOS Stream 10 and upstream stable backports (1162-1244)
  - RHEL changelog for 211.17.1..211.18.1 follows:


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.19.1.el10_2]
changelog:
  - Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322}
  - Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903]
  - Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903]
  - Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903]
  - Bluetooth: hci_conn: Fix using conn->le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903]
  - Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903]
  - Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903]
  - Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903]
  - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329}
  - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824]
  - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824]
  - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821]
  - dpll: add pin operational state (Ivan Vecera) [RHEL-175821]
  - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827]
  - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827]
  - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827]
  - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827]
  - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709}
  - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277]
  - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277]
  - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277]
  - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277]
  - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837]
  - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837]
  - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837]
  - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930]
  - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930]
  - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930]
  - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930]
  - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930]
  - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930]
  - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930]
  - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930]
  - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302]
  - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366}
  - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653}
  - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653}
  - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.20.1.el10_2]
changelog:
  - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243}
  - redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469]
  - sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950]
  - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613}
  - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466]


author: Andrew Lukoshko <alukoshko@almalinux.org> - 6.12.0-211.20.1
changelog:
  - Recreate RHEL 6.12.0-211.20.1 from CentOS Stream 10 and upstream stable backports (1245-1287)
  - smb cifs.spnego now shipped by RHEL too; existing ahead-fix 1105 is identical (RHEL's redundant copy omitted)
  - RHEL changelog for 211.19.1..211.20.1 follows:


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.21.1.el10_2]
changelog:
  - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473]
  - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473]
  - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473]
  - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518]
  - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855]
  - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.22.1.el10_2]
changelog:
  - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932]
  - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932]
  - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932]
  - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932]
  - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932]
  - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932]
  - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932]
  - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932]
  - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932]
  - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932]
  - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932]
  - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932]
  - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932]
  - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932]
  - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932]
  - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932]
  - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932]
  - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932]
  - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932]
  - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932]
  - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932]
  - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932]
  - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932]
  - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932]
  - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932]
  - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932]
  - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932]
  - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932]
  - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
  - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
  - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
  - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
  - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
  - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
  - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
  - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
  - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
  - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
  - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
  - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
  - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
  - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
  - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
  - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
  - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
  - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
  - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
  - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
  - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
  - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
  - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
  - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437]
  - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501}
  - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037}
  - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581}
  - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467}
  - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532}
  - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788]


author: Andrew Lukoshko <alukoshko@almalinux.org> - 6.12.0-211.22.1
changelog:
  - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352)
  - RHEL changelog for 211.21.1..211.22.1 follows:


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.24.1.el10_2]
changelog:
  - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319]
  - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723]
  - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127]
  - objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495]
  - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260}
  - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125}
  - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152}
  - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166}
  - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056}
  - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774]
  - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474}
  - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786}
  - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772}
  - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787}
  - rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.25.1.el10_2]
changelog:
  - gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann)
  - redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299]
  - watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299]
  - mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.26.1.el10_2]
changelog:
  - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331}
  - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
  - crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}
  - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056}


author: Andrew Lukoshko <alukoshko@almalinux.org> - 6.12.0-211.26.1
changelog:
  - Recreate RHEL 6.12.0-211.26.1 from CentOS Stream 10 and upstream stable backports (1352-1373)
  - Enable watchdog pretimeout panic functionality for x86 via kernel config (RHEL-182299)
  - RHEL changelog for 211.23.1..211.26.1 follows:


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.2.1.el10_2]
changelog:
  - selftests: kvm: Verify TILELOADD actually #NM faults when XFD[18]=1 (Maxim Levitsky) [RHEL-148618]
  - selftests: kvm: try getting XFD and XSAVE state out of sync (Maxim Levitsky) [RHEL-148618]
  - selftests: kvm: replace numbered sync points with actions (Maxim Levitsky) [RHEL-148618]
  - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Maxim Levitsky) [RHEL-148618]
  - KVM: selftests: Add ex_str() to print human friendly name of exception vectors (Maxim Levitsky) [RHEL-148618]
  - KVM: x86: Define AMD's #HV, #VC, and #SX exception vectors (Maxim Levitsky) [RHEL-148618]
  - KVM: x86: Define Control Protection Exception (#CP) vector (Maxim Levitsky) [RHEL-148618]
  - KVM: x86: Add human friendly formatting for #XM, and #VE (Maxim Levitsky) [RHEL-148618]
  - KVM: selftests: Add support for #DE exception fixup (Maxim Levitsky) [RHEL-148618]
  - idpf: export RX hardware timestamping information to XDP (Michal Schmidt) [RHEL-136674]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.3.1.el10_2]
changelog:
  - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek)
  - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908]
  - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367]
  - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800]
  - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714]
  - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714]
  - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521]
  - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521]
  - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.4.1.el10_2]
changelog:
  - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353]
  - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700]
  - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231}
  - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111}
  - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231]
  - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209}
  - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652]
  - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652]
  - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815]
  - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815]
  - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815]
  - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815]
  - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815]
  - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815]
  - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.5.1.el10_2]
changelog:
  - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156}
  - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265]
  - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722]
  - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722]
  - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461]
  - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461]
  - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461]
  - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461]
  - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461]
  - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461]
  - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210}
  - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204}
  - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408]
  - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144}
  - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323]
  - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323]
  - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632]
  - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632]
  - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632]
  - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632]
  - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632]
  - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632]
  - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632]
  - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632]
  - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632]
  - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632]
  - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632]
  - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632]
  - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632]
  - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632]
  - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632]
  - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632]
  - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632]
  - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632]
  - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632]
  - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632]
  - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632]
  - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632]
  - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632]
  - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632]
  - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632]
  - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632]
  - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632]
  - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632]
  - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632]
  - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632]
  - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632]
  - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.6.1.el10_2]
changelog:
  - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441]
  - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243}
  - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546]
  - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278]
  - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040}
  - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936]
  - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.7.1.el10_2]
changelog:
  - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673]
  - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673]
  - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053]
  - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053]
  - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053]
  - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053]
  - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053]
  - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053]
  - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053]
  - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053]
  - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053]
  - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270]
  - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415]
  - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415]
  - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171}
  - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191}


author: Andrew Lukoshko <alukoshko@almalinux.org> [6.12.0-211.7.1.el10_2]
changelog:
  - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko)
  - kabi: enable check-kabi (Čestmír Kalina)
  - kabi: add symbols to stablelist (Čestmír Kalina)
  - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver)
  - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver)
  - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver)
  - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver)
  - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver)
  - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver)
  - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver)


author: Andrew Lukoshko <alukoshko@almalinux.org> - 6.12.0-211.7.1
changelog:
  - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec
  - crypto: scatterwalk - Backport memcpy_sglist()
  - crypto: algif_aead - use memcpy_sglist() instead of null skcipher
  - crypto: algif_aead - Revert to operating out-of-place
  - crypto: algif_aead - snapshot IV for async AEAD requests
  - crypto: authenc - use memcpy_sglist() instead of null skcipher
  - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption
  - crypto: authencesn - Fix src offset when decrypting in-place
  - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl
  - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024
  - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024
  - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024
  - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024
  - qla4xxx: bring back deprecated PCI ids
  - be2iscsi: bring back deprecated PCI ids
  - kernel/rh_messages.h: enable all disabled pci devices by moving to
    unmaintained


author: Andrew Lukoshko <alukoshko@almalinux.org> - 6.12.0-211.7.3
changelog:
  - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284)
  - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500)
  - net: skbuff: propagate shared-frag marker through frag-transfer helpers
    (CVE-2026-46300 "Fragnesia")
  - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe
    replacement for upstream 31e62c2ebbfd, Qualys Security Advisory)


author: Andrew Lukoshko <alukoshko@almalinux.org> - 6.12.0-211.7.4
changelog:
  - net: skbuff: propagate shared-frag marker through frag-transfer helpers
    (refresh to upstream v5: now also covers skb_segment() and
    tcp_clone_payload(); CVE-2026-46300 "Fragnesia")
  - smb: client: reject userspace cifs.spnego descriptions (upstream commit
    3da1fdf4efbc)


author: Fedora Release Engineering <releng@fedoraproject.org> - 2:18.1.2-0.4
changelog:
  - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
  - with python3-Cython -> python3dist(cython) < 3~~


author: Fedora Release Engineering <releng@fedoraproject.org> - 2:18.1.2-0.5
changelog:
  - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
  - revert python3-Cython -> python3dist(cython) < 3~~


author: Kaleb S. KEITHLEY <kkeithle[at]redhat.com> - 2:18.2.1-2
changelog:
  - ceph-18.2.1, incorporate changes from *final* 18.2.1 release from
    https://download.ceph.com/rpm-18.2.1/el9/SRPMS/ceph-18.2.1-0.el9.src.rpm


author: Andreas Schneider <asn@redhat.com> - 1.4.0-1
changelog:
  - Update to version 1.4.0
    * https://gitlab.com/cwrap/socket_wrapper/-/blob/socket_wrapper-1.4.0/CHANGELOG


author: Jiri Denemark <jdenemar@redhat.com> - 11.10.0-4
changelog:
  - qemuDomainSetThrottleGroup: Enforce non-zero 'groupname' string length (RHEL-141820)
  - qemuDomainSetBlockIoTuneField: Move setting of 'group_name' out of the loop (RHEL-141820)
  - qemuDomainSetThrottleGroup: Always honour thottle group name passed as argument (RHEL-141820)
  - qemuDomainSetThrottleGroup: Don't put group name into the 'tunable' event twice (RHEL-141820)
  - qemuSnapshotDiskHasBackingDisk: Avoid call of virStorageSourceIsSameLocation with NULL argument (RHEL-144089)
  - qemuSnapshotUpdateBackingStore: Remove stale comment (RHEL-144089)
  - qemuSnapshotDiskHasBackingDisk: Use proper 'max_depth' when calling 'virStorageSourceGetMetadata' (RHEL-144089)
  - virDomainSnapshotDefAssignExternalNames: Improve error message (RHEL-144089)
  - qemuSnapshotUpdateBackingStore: Retry as curent user if qemu-img fails (RHEL-144089)
  - esx: Debug URL just before opening with curl (RHEL-138300)
  - esx: Abstract all URL-creation code into one function (RHEL-138300)
  - esx: Switch to creating URLs using virURIFormat (RHEL-138300)
  - esx_util: Introduce esxUtil_EscapeInventoryObject() (RHEL-140196)
  - esx: URI encode inventory objects twice (RHEL-140196)


author: Jiri Denemark <jdenemar@redhat.com> - 11.10.0-5
changelog:
  - qemublocktest: Iterate all nodenames in 'testQemuDetectBitmaps' (RHEL-145769)
  - qemu: monitor: Detect list of bitmaps from 'qcow2' format specific data (RHEL-145769)
  - qemuMigrationDstPrepareAnyBlockDirtyBitmaps: Fix check for existing bitmaps (RHEL-145769)
  - qemu: migration: Always offer block dirty bitmaps during migration (RHEL-145769)
  - qemuMigrationDstPrepareAnyBlockDirtyBitmaps: Always consider offered bitmaps (RHEL-145769)


author: Jiri Denemark <jdenemar@redhat.com> - 11.10.0-6
changelog:
  - qemu: Implement support for associating iommufd to hostdev (RHEL-126346, RHEL-74202)
  - qemu: Introduce privateData for hostdevs (RHEL-126346, RHEL-74202)
  - qemu: Support per-process memory accounting for iommufd (RHEL-126346, RHEL-74202)
  - qemu: open VFIO FDs from libvirt backend (RHEL-126346, RHEL-74202)
  - qemu: open iommufd FD from libvirt backend (RHEL-126346, RHEL-74202)
  - qemu: Update Cgroup, namespace, and seclabel for iommufd (RHEL-126346, RHEL-74202)
  - tests: qemuxmlconfdata: provide iommufd sample XML and CLI args (RHEL-126346, RHEL-74202)


author: Jiri Denemark <jdenemar@redhat.com> - 11.10.0-8
changelog:
  - src/esx/esx_vi.c: Debug path element comparisons (RHEL-145080)
  - qemu: Ignore cmp_legacy CPU flag (RHEL-148494)


author: Jiri Denemark <jdenemar@redhat.com> - 11.10.0-9
changelog:
  - qemu: capabilities: Probe properties of 'scsi-block' and 'scsi-generic' devices (RHEL-135115)
  - qemu: capabilities: Introduce QEMU_CAPS_DEVICE_SCSI_BLOCK_MIGRATE_PR (RHEL-135115)
  - RHEL-ONLY: backport test data for 'migrate-pr' capability of 'scsi-block' (RHEL-135115)
  - qemu: Implement support for persistent reservation migration control (RHEL-135115)
  - qemu: Extract disk setup done via QMP into a separate helper (RHEL-131335)
  - qemu: process: Rename 'qemuProcessSetupDiskThrottling' to 'qemuProcessSetupDisks' (RHEL-131335)
  - qemu: monitor: Extract block latency histogram stats into 'qemuBlockStats' (RHEL-131335)
  - Expose latency histograms via 'virConnectGetAllDomainStats' (RHEL-131335)
  - qemu: monitor: Add handlers for 'block-latency-histogram-set' (RHEL-131335)
  - docs: formatdomain: Fix indentation of docs for <disk><driver><statistics> element (RHEL-131335)
  - docs: formatdomain: Reword section about the '<statistics>' element under disk driver (RHEL-131335)
  - Introduce support for disk operation latency histogram collection (RHEL-131335)
  - qemu: Setup disk latency histograms on startup/hotplug/update (RHEL-131335)


author: Jiri Denemark <jdenemar@redhat.com> - 11.10.0-10
changelog:
  - qemu: Introduce QEMU_CAPS_OBJECT_IOMMUFD (RHEL-150351)
  - qemu: Move IOMMUFD validation to qemu_validate (RHEL-150351)
  - util: Move openning IOMMU device to viriommufd (RHEL-150351)
  - qemu_process: Refactor qemuProcessOpenIommuFd (RHEL-150351)
  - util: Move openning VFIO device to virpci (RHEL-150351)
  - qemu_process: Refactor qemuProcessOpenVfioDeviceFd (RHEL-150351)
  - util: Use virPCIDevice as argument in virPCIDeviceGetVfioPath (RHEL-150351)
  - conf: Introduce virHostdevIsPCIDeviceWithIOMMUFD (RHEL-150351)
  - conf: Introduce virDomainDefHasPCIHostdevWithIOMMUFD (RHEL-150351)
  - qemu_domain: Add missing IOMMUFD cleanup (RHEL-150351)
  - qemu_process: Fix FD leak with multiple host devices using IOMMUFD (RHEL-150351)
  - qemu_process: Refactor qemuProcessOpenVfioFds (RHEL-150351)
  - qemuxmlconftest: Refactor host device preparation (RHEL-150351)
  - qemuxmlconftest: Rename and refactor testSetupHostdevPrivateData (RHEL-150351)
  - qemuxmlconftest: Set fake FD for IOMMUFD (RHEL-150351)
  - qemu: Convert IOMMUFD to qemuFDPassDirect (RHEL-150351)
  - qemu: Convert vfioDeviceFd to qemuFDPassDirect (RHEL-150351)
  - qemu_command: Don't use host property if IOMMUFD is used (RHEL-150351)
  - qemu: Save IOMMUFD state into status XML (RHEL-150351)
  - qemu_hotplug: Remove iommufd object if no longer needed (RHEL-150351)
  - qemu_command: Extract building IOMMUFD props to function (RHEL-150351)
  - qemu_hotplug: Add support to hotplug host device with IOMMUFD (RHEL-150351)
  - conf: Introduce iommufd enum for domaincaps (RHEL-148135)
  - qemu: Fill iommufd domain capability (RHEL-148135)
  - tests: properly mock VFIO and IOMMU checks (RHEL-148135)
  - iommufd: fix FD leak in case of error (RHEL-150351)


author: Jiri Denemark <jdenemar@redhat.com> - 11.10.0-11
changelog:
  - qemu_firmware: Drop support for kernel descriptors (RHEL-82645)
  - qemu_firmware: Drop 'nvram' local variable (RHEL-82645)
  - qemu_firmware: Move format=raw compat exception (RHEL-82645)
  - qemu_firmware: Move copying of nvram.format to loader.format (RHEL-82645)
  - tests: Add firmware-manual-efi-rw-nvram (RHEL-82645)
  - domain_validate: Reject NVRAM with read/write firmware (RHEL-82645)
  - tests: Add firmware-auto-bios-rw (RHEL-82645)
  - tests: Add firmware-manual-bios-rw (RHEL-82645)
  - domain_validate: Reject read/write ROMs (RHEL-82645)
  - tests: Add firmware-auto-efi-format-loader-qcow2-rom (RHEL-82645)
  - domain_validate: Reject ROMs with format other than raw (RHEL-82645)
  - qemu_firmware: Ignore stateless/combined when NVRAM is configured (RHEL-82645)
  - qemu_firmware: Drop fallback for absent nvramTemplateFormat (RHEL-82645)
  - schemas: Allow templateFormat without template path (RHEL-82645)
  - tests: Add firmware-manual-efi-nvram-template-nonstandard-format (RHEL-82645)
  - tests: Add firmware-manual-efi-nvram-template-nonstandard-legacy-paths (RHEL-82645)
  - tests: Add firmware-auto-efi-format-nvram-raw (RHEL-82645)
  - tests: Add firmware-auto-efi-format-nvram-raw-loader-path (RHEL-82645)
  - tests: Add firmware-auto-efi-format-nvram-raw-nvramtemplate-path (RHEL-82645)
  - tests: Add firmware-auto-efi-format-nvramtemplate-qcow2 (RHEL-82645)
  - tests: Add firmware-auto-efi-format-mismatch-nvramtemplate (RHEL-82645)
  - qemu_firmware: Introduce qemuFirmwareFillDomainCustom() (RHEL-82645)
  - qemu_firmware: Set templateFormat for custom paths (RHEL-82645)
  - qemu_firmware: Simplify handling of legacy paths (RHEL-82645)
  - qemu_firmware: Refactor setting NVRAM format (RHEL-82645)
  - qemu_firmware: Prefer template format to loader format (RHEL-82645)
  - qemu_firmware: Retain user-specified NVRAM format (RHEL-82645)
  - qemu_firmware: Take templateFormat into account when matching (RHEL-82645)
  - qemu_firmware: Take NVRAM format into account when matching (RHEL-82645)
  - qemu_firmware: Remove NVRAM to loader format copy hack (RHEL-82645)
  - tests: Add firmware-manual-efi-sev-snp (RHEL-82645)
  - tests: Add firmware-manual-efi-tdx (RHEL-82645)
  - qemu_firmware: ROM firmware is always in raw format (RHEL-82645)
  - qemu_firmware: Don't skip autoselection for ROM (RHEL-82645)
  - qemu_firmware: Allow matching both UEFI and BIOS for ROM loader (RHEL-82645)
  - schema: Add firmwareFeatures element for domaincaps (RHEL-82645)
  - conf: Add firmwareFeatures element for domaincaps (RHEL-82645)
  - qemu: Fill in firmwareFeature element for domaincaps (RHEL-82645)
  - docs: Document firmwareFeature element for domaincaps (RHEL-82645)
  - docs: Rename "BIOS bootloader" section to "guest firmware" (RHEL-82645)
  - docs: Improvement related to firmware selection (RHEL-82645)
  - qemu_firmware: Only set format for custom loader if path is present (RHEL-82645)
  - conf: Move type=rom default for loader to drivers (RHEL-82645)
  - tests: Rename custom JSON firmware descriptors (RHEL-82645)
  - schema: Introduce osnvram define (RHEL-82645)
  - conf: Parse and format varstore element (RHEL-82645)
  - conf: Update validation to consider varstore element (RHEL-82645)
  - qemu_capabilities: Introduce QEMU_CAPS_DEVICE_UEFI_VARS (RHEL-82645)
  - qemu: Validate presence of uefi-vars device (RHEL-82645)
  - tests: Add firmware-manual-efi-varstore-q35 (RHEL-82645)
  - tests: Add firmware-manual-efi-varstore-aarch64 (RHEL-82645)
  - tests: Add firmware-auto-efi-varstore-q35 (RHEL-82645)
  - tests: Add firmware-auto-efi-varstore-aarch64 (RHEL-82645)
  - tests: Add firmware-auto-efi-enrolled-keys-aarch64 (RHEL-82645)
  - qemu_firmware: Parse host-uefi-vars firmware feature (RHEL-82645)
  - qemu_firmware: Split sanity check (RHEL-82645)
  - qemu_firmware: Consider host-uefi-vars feature in sanity check (RHEL-82645)
  - qemu_firmware: Support extended syntax for ROM firmware descriptors (RHEL-82645)
  - qemu_firmware: Report NVRAM template path for ROMs (RHEL-82645)
  - conf: Include varstore element in domcaps (RHEL-82645)
  - qemu: Fill in varstore element in domcaps (RHEL-82645)
  - qemu_firmware: Use of NVRAM implies stateful firmware (RHEL-82645)
  - qemu_firmware: Allow matching stateful ROMs (RHEL-82645)
  - qemu_firmware: Fill in varstore information (RHEL-82645)
  - qemu: Introduce varstoreDir (RHEL-82645)
  - qemu_firmware: Generate varstore path when necessary (RHEL-82645)
  - qemu: Introduce qemuPrepareNVRAMFileCommon() (RHEL-82645)
  - qemu: Create and delete varstore file (RHEL-82645)
  - security: Mark ROMs as read only when using AppArmor (RHEL-82645)
  - security: Handle varstore file (RHEL-82645)
  - tests: Add firmware descriptors for uefi-vars builds (RHEL-82645)
  - qemu_command: Use uefi-vars device where appropriate (RHEL-82645)
  - include: Mention varstore where applicable (RHEL-82645)
  - virsh: Update for varstore handling (RHEL-82645)
  - domain_conf: initialize network hostdev private data (RHEL-151916)
  - qemu_hotplug: enter monitor in order to rollback passed FD (RHEL-151916)


author: Jiri Denemark <jdenemar@redhat.com> - 11.10.0-12
changelog:
  - test: Default to ROM type for loader (RHEL-82645)
  - qemu_hotplug: Fix crash when attaching network inteface with hostdev network (RHEL-151916)


author: Dominik Mierzejewski <rpm@greysector.net> - 2.16.01-1
changelog:
  - update to 2.16.01 (#2155636)
  - drop obsolete patch
  - drop rdoff subpackage (discontinued upstream)


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.52.2-1
changelog:
  - Rebase to libguestfs 1.52.2 (along the stable branch)
  - Remove dependency on syslinux packages
    resolves: RHEL-50565


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.52.2-4
changelog:
  - Synchronize patches with RHEL 9.5
    resolves: RHEL-56325
  - appliance/init: Don't set impossible "noop" disk scheduler
    resolves: RHEL-56157


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.54.0-5
changelog:
  - Rebase to libguestfs 1.54.0
    resolves: RHEL-56810
  - Fix osinfo for Windows Server 2025
    resolves: RHEL-62989
  - Replace Jansson with json-c
    resolves: RHEL-65293
  - Remove squashfs-tools on RHEL
    resolves: RHEL-68937
  - Fix perl-Sys-Guestfs debuginfo
    resolves: RHEL-68973


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.56.1-3
changelog:
  - Rebase to libguestfs 1.56.1
    resolves: RHEL-81733
  - Include host kernel information in libguestfs debugging output
    resolves: RHEL-83026
  - Fix virt-v2v conversion of split /usr Ubuntu 22+
    resolves: RHEL-87622
  - Remove dependencies on oUnit, flex, bison, file-devel
  - Remove zfs-fuse (not used in RHEL)
  - Fix gating test
  - Fix inspection with duplicated root mountpoint
    resolves: RHEL-90170
  - Add btrfs-scrub-full API
    resolves: RHEL-91936
  - Add e2fsck forceno flag
    resolves: RHEL-92599
  - Capture and raise qemu-img stderr
    resolves: RHEL-92239
  - Ignore btrfs snapshots of roots
    resolves: RHEL-93109
  - Add /etc/fstab, lsblk and blkid to verbose output
    resolves: RHEL-106490
  - Fix conversion of SLES15 with encrypted btrfs filesystem
    resolves: RHEL-93584
  - Add guestfs_setfiles API
    resolves: RHEL-108832
  - Ignore blank disks in Windows drive mapping
    resolves: RHEL-109258


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.58.1-2
changelog:
  - Rebase to libguestfs 1.58.1
    resolves: RHEL-111240
  - Synchronize spec file with Fedora
  - Add new libguestfs ntfs_chmod API
    resolves: RHEL-113833
  - Use setfiles -A option if available to reduce memory usage
    resolves: RHEL-114292
  - Add -cpu max when testing for KVM via QMP
    resolves: RHEL-121076
  - Require passt
    resolves: RHEL-122315
  - Add AV and GPOs to inspection info
    resolves: RHEL-125846
  - Add new xfs_info2 API
    resolves: RHEL-143673


author: Andrew Lukoshko <alukoshko@almalinux.org> - 1:1.58.1-6.alma.1
changelog:
  - Update to libguestfs-1.58.1-6
  - daemon/listfs.ml: ignore CHS geometry error from parted (Veritas/Sun)
  - daemon: allow base64:/text: prefixes on Key parameters (binary LUKS keys)
  - daemon: move read_whole_file to common/utils and rewrite luks_* APIs in OCaml
  - Update common submodule
  - Apply patches with %autosetup -S git (a patch now adds binary test data)


author: Ondrej Sloup <osloup@redhat.com> - 1.3.2-74
changelog:
  - Use %{buildroot} instead of $RPM_BUILD_ROOT as it is more recent
  - Use directory macros and push/popd


author: Ondrej Sloup <osloup@redhat.com> - 1.3.2-75
changelog:
  - Fix installation on OSTree by removing %ghost (rhbz#2193429)
  - Remove %ldconfig_postun as it has no effect in Fedora


author: Ondrej Sloup <osloup@redhat.com> - 1.3.2-77
changelog:
  - Sync the RHEL version and Fedora version of the specfile
  - Update sources file and config.{sub|guess}
  - Skip verification for .soc file as it will change after install


author: Jitka Plesnikova <jplesnik@redhat.com> - 1.227-1
changelog:
  - Update to 1.227
    - New maintainer, GTERMARS
    - Add basic GitHub Actions setup for testing
    - Typo corrections in POD
    - Eliminated use of state/node files in temp directory


author: Paul Howarth <paul@city-fan.org> - 1.18-1
changelog:
  - Update to 1.18 (rhbz#2251844)
    - Address Freebsd build issue: make function checks more robust within
      shared lib (GH#35)


author: Paul Howarth <paul@city-fan.org> - 1.20-1
changelog:
  - Update to 1.20 (rhbz#2256127)
    - Remove --no-undefined from compiler test, which is not compatible with all
      platforms (GH#37)
    - Skip t/pty_get_winsize.t tests on AIX (GH#32)
    - Fix patchlevel check for util.h (GH#27)


author: Paul Howarth <paul@city-fan.org> - 0.03-48
changelog:
  - Spec tidy-up
    - Use SPDX-format license tag
    - Use author-independent source URL
    - Specify all dependencies
    - Fix permissions verbosely
    - Simplify find commands using -empty and -delete
    - Make %files list more explicit


author: Jitka Plesnikova <jplesnik@redhat.com> - 4.2.1-1
changelog:
  - Resolves: RHEL-32325
  - 4.2.1 bump
  - Fix gcc's -Wformat-security warning in R Raise function
  - OCaml 5.2.0 ppc64le fix
  - Add support for Python 3.13


author: Andreas Schneider <asn@redhat.com> - 1.3.0-1
changelog:
  - Update to version 1.3.0
    o https://gitlab.com/cwrap/uid_wrapper/-/blob/uid_wrapper-1.3.0/CHANGELOG


