This package provides kernel modules for the kernel package for AlmaLinux partners usage.
Provides
Requires
License
((GPL-2.0-only WITH Linux-syscall-note) OR BSD-2-Clause) AND ((GPL-2.0-only WITH Linux-syscall-note) OR BSD-3-Clause) AND ((GPL-2.0-only WITH Linux-syscall-note) OR CDDL-1.0) AND ((GPL-2.0-only WITH Linux-syscall-note) OR Linux-OpenIB) AND ((GPL-2.0-only WITH Linux-syscall-note) OR MIT) AND ((GPL-2.0-or-later WITH Linux-syscall-note) OR BSD-3-Clause) AND ((GPL-2.0-or-later WITH Linux-syscall-note) OR MIT) AND 0BSD AND BSD-2-Clause AND (BSD-2-Clause OR Apache-2.0) AND BSD-3-Clause AND BSD-3-Clause-Clear AND CC0-1.0 AND GFDL-1.1-no-invariants-or-later AND GPL-1.0-or-later AND (GPL-1.0-or-later OR BSD-3-Clause) AND (GPL-1.0-or-later WITH Linux-syscall-note) AND GPL-2.0-only AND (GPL-2.0-only OR Apache-2.0) AND (GPL-2.0-only OR BSD-2-Clause) AND (GPL-2.0-only OR BSD-3-Clause) AND (GPL-2.0-only OR CDDL-1.0) AND (GPL-2.0-only OR GFDL-1.1-no-invariants-or-later) AND (GPL-2.0-only OR GFDL-1.2-no-invariants-only) AND (GPL-2.0-only WITH Linux-syscall-note) AND GPL-2.0-or-later AND (GPL-2.0-or-later OR BSD-2-Clause) AND (GPL-2.0-or-later OR BSD-3-Clause) AND (GPL-2.0-or-later OR CC-BY-4.0) AND (GPL-2.0-or-later WITH GCC-exception-2.0) AND (GPL-2.0-or-later WITH Linux-syscall-note) AND ISC AND LGPL-2.0-or-later AND (LGPL-2.0-or-later OR BSD-2-Clause) AND (LGPL-2.0-or-later WITH Linux-syscall-note) AND LGPL-2.1-only AND (LGPL-2.1-only OR BSD-2-Clause) AND (LGPL-2.1-only WITH Linux-syscall-note) AND LGPL-2.1-or-later AND (LGPL-2.1-or-later WITH Linux-syscall-note) AND (Linux-OpenIB OR GPL-2.0-only) AND (Linux-OpenIB OR GPL-2.0-only OR BSD-2-Clause) AND Linux-man-pages-copyleft AND MIT AND (MIT OR Apache-2.0) AND (MIT OR GPL-2.0-only) AND (MIT OR GPL-2.0-or-later) AND (MIT OR LGPL-2.1-only) AND (MPL-1.1 OR GPL-2.0-only) AND (X11 OR GPL-2.0-only) AND (X11 OR GPL-2.0-or-later) AND Zlib AND (copyleft-next-0.3.1 OR GPL-2.0-or-later)
Changelog
* Thu Nov 05 2026 Eduard Abdullin <eabdullin@almalinux.org> - 6.12.0-211.74.1
- Debrand for AlmaLinux OS
- Use AlmaLinux OS secure boot cert
* Thu Nov 05 2026 Neal Gompa <ngompa@almalinux.org> - 6.12.0-211.74.1
- Enable Btrfs support for all kernel variants
* Thu Nov 05 2026 Andrew Lukoshko <alukoshko@almalinux.org> - 6.12.0-211.74.1
- ceph: pass cred pointer to ceph_mds_auth_match()
- ceph: fix cred leak in ceph_mds_check_access() {CVE-2024-56563}
- ceph: fix memory leak in ceph_mds_auth_match() {CVE-2025-21737}
- bnxt_en: fix DMA mapping length for padded small packets
- ceph: give up on paths longer than PATH_MAX {CVE-2024-53685}
- ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419}
- ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408}
- hpsa: bring back deprecated PCI ids #CFHack #CFHack2024
- mptsas: bring back deprecated PCI ids #CFHack #CFHack2024
- megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024
- qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024
- qla4xxx: bring back deprecated PCI ids
- be2iscsi: bring back deprecated PCI ids
- kernel/rh_messages.h: enable all disabled pci devices by moving to
unmaintained
* Wed Nov 04 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.74.1.el10_2]
- sunrpc: wait for in-flight TLS handshake callback when cancel loses race (Olga Kornievskaia) [RHEL-283649] {CVE-2026-72221}
- sunrpc: pin svc_xprt across the asynchronous TLS handshake callback (Olga Kornievskaia) [RHEL-283263] {CVE-2026-72222}
- fs/resctrl: Fix use-after-free during unmount (Dennis Chen) [RHEL-296708] {CVE-2026-72080}
- xfs: fix exchange-range-to-eof file size exchange (Carlos Maiolino) [RHEL-292986] {CVE-2026-98974}
- xfs: stop exchanging reflink flags when exchanging mappings (Carlos Maiolino) [RHEL-292986] {CVE-2026-98974}
- sctp: clear new_transport when removing a peer (CKI Backport Bot) [RHEL-275369] {CVE-2026-74586}
- writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() (Ian Kent) [RHEL-260509] {CVE-2026-64378}
- openvswitch: Fix CT limit teardown use-after-free (Timothy Redaelli) [RHEL-263515] {CVE-2026-89488}
- PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers (Aristeu Rozanski) [RHEL-267082] {CVE-2026-90315}
* Mon Nov 02 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.73.1.el10_2]
- ethtool: cmis: require exact CDB reply length (CKI Backport Bot) [RHEL-229674] {CVE-2026-63996}
* Sun Nov 01 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.72.1.el10_2]
- ipv4: free inet_opt and ireq_opt after an RCU grace period (CKI Backport Bot) [RHEL-295608] {CVE-2026-98432}
- x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-230757] {CVE-2026-46174}
- selftests: netfilter: use KHDR_INCLUDES in CFLAGS (CKI Backport Bot) [RHEL-291348]
- netfilter: conntrack: make filtering by zone discoverable (CKI Backport Bot) [RHEL-291348]
- selftests: netfilter: conntrack_dump_flush: remove unused variables and fix typo (CKI Backport Bot) [RHEL-291348]
- netlink: specs: fix the conntrack filter type (CKI Backport Bot) [RHEL-291348]
- netfilter: report NLM_F_DUMP_FILTERED when all is filtered out (CKI Backport Bot) [RHEL-291348]
- xfrm: hold net_device reference under RCU in bundle creation (Abhishek Rawal) [RHEL-277962] {CVE-2026-98364}
- tipc: require net admin for TIPCv2 netlink mutators (CKI Backport Bot) [RHEL-273184] {CVE-2026-74283}
- entry: Fix seccomp bypass after ptrace with TSYNC (Audra Mitchell) [RHEL-271405] {CVE-2026-89603}
- ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF (Abhishek Rawal) [RHEL-248847] {CVE-2026-68398}
- net: sock: fix hardened usercopy panic in sock_recv_errqueue (CKI Backport Bot) [RHEL-189611] {CVE-2026-22977}
* Fri Oct 30 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.71.1.el10_2]
- nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() (Maurizio Lombardi) [RHEL-290598] {CVE-2026-98725}
- net: skbuff: propagate shared-frag marker in skb_zerocopy() (Xin Long) [RHEL-291156]
- smb: client: bound dirent name against end of SMB response in cifs_filldir (Paulo Alcantara) [RHEL-278330] {CVE-2026-93787}
* Wed Oct 28 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.70.1.el10_2]
- scsi: target: iscsi: Reserve a terminator byte for the login payload (CKI Backport Bot) [RHEL-285628] {CVE-2026-90011}
- virtio-fs: avoid double-free on failed queue setup (CKI Backport Bot) [RHEL-278134] {CVE-2026-93827}
- KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279482] {CVE-2026-98222}
- mptcp: options: reset DSS fields in case of unexpected size (Prasenjit Mukherjee) [RHEL-250579] {CVE-2026-80586}
- mptcp: pm: userspace: fix use-after-free in get_local_id (Prasenjit Mukherjee) [RHEL-236704] {CVE-2026-68169}
- KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU (Rahul Kumar) [RHEL-270935] {CVE-2026-89932}
- KVM: nVMX: Decouple INVVPID operand checks from flushing of vpid02 (Rahul Kumar) [RHEL-270935] {CVE-2026-89932}
- KVM: nVMX: Always flush vpid02 on first use (Rahul Kumar) [RHEL-270935] {CVE-2026-89932}
- arp: do not assume dev_hard_header() does not change skb->head (Guillaume Nault) [RHEL-270721]
- ip6_gre: make ip6gre_header() robust (Guillaume Nault) [RHEL-270721]
- ipv4: ip_gre: make ipgre_header() robust (Guillaume Nault) [RHEL-270702]
* Mon Oct 26 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.69.1.el10_2]
- scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (CKI Backport Bot) [RHEL-283521] {CVE-2026-72083}
- md/raid5-ppl: fix use-after-free in ppl_do_flush() (Nigel Croxon) [RHEL-278085] {CVE-2026-93262}
- KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277647] {CVE-2026-74515}
- vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270937] {CVE-2026-89777}
- smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (Jorge San Emeterio Villalain) [RHEL-271266] {CVE-2026-89638}
- net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232133] {CVE-2026-63978}
- net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232133]
- net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230367] {CVE-2026-63979}
- net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234161] {CVE-2026-64523}
- x86/microcode: Add platform mask to Intel microcode "old" list (Luis Claudio R. Goncalves) [RHEL-212778]
- x86/cpu: Add platform ID to CPU matching structure (Luis Claudio R. Goncalves) [RHEL-212778]
- x86/cpu: Add platform ID to CPU info structure (Luis Claudio R. Goncalves) [RHEL-212778]
- x86/microcode: Refactor platform ID enumeration into a helper (Luis Claudio R. Goncalves) [RHEL-212778]
- fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226096] {CVE-2026-53388}
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (CKI Backport Bot) [RHEL-259937]
- sched_ext: Fix unsafe locking in the scx_dump_state() (CKI Backport Bot) [RHEL-259937]
- net: shaper: rework the VALID marking (again) (Jamie Bainbridge) [RHEL-231705] {CVE-2026-64027}
- net: shaper: annotate the data races (Jamie Bainbridge) [RHEL-231705]
- net: shaper: fix trivial ordering issue in net_shaper_commit() (Jamie Bainbridge) [RHEL-231705]
- net: shaper: flip the polarity of the valid flag (Jamie Bainbridge) [RHEL-231705]
- net: shaper: protect late read accesses to the hierarchy (Jamie Bainbridge) [RHEL-231705]
- net/packet: avoid fanout hook re-registration after unregister (Jamie Bainbridge) [RHEL-246967] {CVE-2026-68338}
- af_unix: Fix UAF read of tail->len in unix_stream_data_wait() (Jamie Bainbridge) [RHEL-225883] {CVE-2026-64109}
- af_unix: Cache state->msg in unix_stream_read_generic(). (Jamie Bainbridge) [RHEL-225883]
- net: gro: fix double aggregation of flush-marked skbs (Jamie Bainbridge) [RHEL-242620] {CVE-2026-68136}
- tcp: restrict SO_ATTACH_FILTER to priv users (Jamie Bainbridge) [RHEL-257741] {CVE-2026-53236}
- usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258583] {CVE-2026-80824}
- net: smc: fix splice entry lifetime imbalance in smc_rx_splice (CKI Backport Bot) [RHEL-253457] {CVE-2026-74631}
- ipv4: fib: fix route re-dump in inet_dump_fib() on multi-batch dump (Felix Maurer) [RHEL-245489]
- ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump (Felix Maurer) [RHEL-245489]
* Wed Oct 21 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.68.1.el10_2]
- bonding: only set speed/duplex to unknown, if getting speed failed (Abhishek Rawal) [RHEL-179066]
- drm/amdgpu: Bound GPIO I2C table entry count from VBIOS (Anusha Srivatsa) [RHEL-278280] {CVE-2026-97493}
- drm/amdkfd: Add TLB flush after MES queue eviction/suspension (CKI Backport Bot) [RHEL-262095] {CVE-2026-89811}
- drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260540] {CVE-2026-68236}
- drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258141] {CVE-2026-80887}
- drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236244] {CVE-2026-68245}
- drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240855] {CVE-2026-68278}
- xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253369] {CVE-2026-80536}
- Fix use-after-free when perf mmap() revival races with the last munmap() (Vratislav Bendel) [RHEL-270808] {CVE-2026-89791}
- perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271846] {CVE-2026-93817}
- ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238867] {CVE-2026-68448}
- inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254213] {CVE-2026-80590}
- ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233130] {CVE-2026-64572}
- ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225476] {CVE-2026-64114}
- ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263699] {CVE-2026-68202}
- calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257678] {CVE-2025-38147}
- calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257678] {CVE-2025-38147}
- fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234249] {CVE-2026-64266}
- ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234100] {CVE-2026-64481}
- net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230097] {CVE-2026-64048}
- rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193031]
* Fri Oct 16 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.67.1.el10_2]
- net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-280590]
- ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-280590] {CVE-2026-99999}
- signal: Prevent exec() race (Phil Auld) [RHEL-282048] {CVE-2026-98256}
- posix-timers: Target group sigqueue to current task only if not exiting (Phil Auld) [RHEL-282048]
- exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282070] {CVE-2026-98260}
- smb: client: reject a tree connect response whose byte count is too small (CKI Backport Bot) [RHEL-271291] {CVE-2026-89631}
- smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271484] {CVE-2026-89633}
- xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256678]
- xfrm: nat_keepalive: avoid double free on send error (CKI Backport Bot) [RHEL-256678]
- xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256678]
- xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256678]
- drivers/hv: remove deposited pages from direct map (Paolo Bonzini) [RHEL-267038]
- selftests/mm: hugepage-mremap: fix mapping alignment (Luiz Capitulino) [RHEL-181987]
- sctp: validate cookie AUTH state before use (Xin Long) [RHEL-254315] {CVE-2026-74752}
- sctp: stop processing a packet once its association is deleted (Xin Long) [RHEL-254315] {CVE-2026-89479}
- sctp: avoid auth_enable sysctl UAF during netns teardown (Xin Long) [RHEL-258778] {CVE-2026-68162}
- sctp: keep chunk->transport in step with the list it is queued on (Xin Long) [RHEL-254353] {CVE-2026-74588}
- usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259412] {CVE-2026-63958}
- usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259412]
- usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259412] {CVE-2026-63962}
- usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259412] {CVE-2026-63963}
- usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259412] {CVE-2026-63961}
- redhat/configs: automotive: enable USB_CHIPIDEA_IMX (Jared Kangas) [RHEL-257228]
- Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254672] {CVE-2026-74509}
- openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253867] {CVE-2026-31678}
- openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253867] {CVE-2026-31678}
- tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228912] {CVE-2026-63801}
- tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238046] {CVE-2026-68117}
- sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229479] {CVE-2026-63971}
- sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231579] {CVE-2026-52917}
- sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236158] {CVE-2026-68315}
- sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237097] {CVE-2026-68376}
- sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237097] {CVE-2026-68300}
- s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245336]
- s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245336]
- s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245336]
- s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245336]
- xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222980] {CVE-2026-52935}
* Wed Oct 14 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.66.1.el10_2]
- net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271473] {CVE-2026-80985}
- net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271473] {CVE-2026-80985}
- net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271473] {CVE-2026-80985}
- SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275057] {CVE-2026-93207}
- svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275073] {CVE-2026-93228}
- nfsd: don't free session slots that are still in use (Olga Kornievskaia) [RHEL-270850] {CVE-2026-89689}
- NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270946] {CVE-2026-90036}
- NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270946] {CVE-2026-89659}
- svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271459] {CVE-2026-89526}
- ice: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410]
- iavf: send MAC change request synchronously (Jose Ignacio Tornos Martinez) [RHEL-143410]
- i40e: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410]
- iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test (Jose Ignacio Tornos Martinez) [RHEL-143410]
- media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262501] {CVE-2026-89894}
- ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261677] {CVE-2026-72262}
- net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260529] {CVE-2026-68140}
- wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CKI Backport Bot) [RHEL-259554] {CVE-2026-64030}
- USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63956}
- USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63957}
- USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63928}
- USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63899}
- netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Phil Sutter) [RHEL-230721] {CVE-2026-45859}
- ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256452] {CVE-2026-74641}
- dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CKI Backport Bot) [RHEL-254620] {CVE-2026-74574}
- idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243402] {CVE-2026-68291}
- idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243402] {CVE-2026-53286}
- idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243402] {CVE-2026-64162}
- idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243402] {CVE-2026-31647}
- Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974}
- Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974}
- net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240917] {CVE-2026-68377}
- bridge: mcast: Fix a possible use-after-free when removing a bridge port (CKI Backport Bot) [RHEL-232531] {CVE-2026-64032}
- net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229655] {CVE-2026-46319}
- net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226492] {CVE-2026-53011}
- ionic: convert to ndo_hwtstamp API (CKI Backport Bot) [RHEL-165657]
* Fri Oct 09 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.65.1.el10_2]
- nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970}
- thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332}
- bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508}
- x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507}
- bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508}
- tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027]
- net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027]
- net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027]
- net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027]
- net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027]
- net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027]
- tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027]
- tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027]
- af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521}
- openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123}
- macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925}
- cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318}
- smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385}
- KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289}
- i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191}
* Wed Oct 07 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.64.1.el10_2]
- ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805]
- ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805]
- ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805]
- ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805]
- udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705}
- nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690}
- svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530}
- nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676}
- nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675}
- nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669}
- nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663}
- nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134]
- nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134]
- NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398}
- SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317}
- vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268]
- macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268]
- ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744}
- ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103}
- vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970}
- vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365}
- vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365}
- KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360}
- KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360}
- KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360}
- KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360}
- KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360}
- KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360}
- KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360}
- KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360}
- KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360}
- KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360}
- KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360}
- KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360}
- KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360}
- vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115}
- mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709]
- mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709]
- platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709]
- igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035}
* Mon Oct 05 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.63.1.el10_2]
- netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288}
- tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024}
- Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275}
- Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275}
- nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227}
- nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972}
- s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888]
- ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132}
- netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417}
- crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972}
- wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457]
- wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457]
- wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457]
- crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457]
- futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003}
- futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469]
- futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775}
- futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778}
- futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758}
- futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776}
- futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658}
- futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469]
- compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469]
- ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476}
- ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792}
- ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924}
- ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922}
- ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984}
- ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920}
- Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557}
- Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557}
- Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557}
- l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918}
- tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992}
- tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994}
- vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432}
- net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052}
- net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829}
- Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357}
- Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357}
- netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320}
- KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921}
- KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516}
- KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516}
- KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516}
- KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516}
- KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516}
- ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669}
- ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669}
- ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669}
- netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255}
- netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394]
- netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394]
- netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394]
- netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078}
- netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394]
- netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394]
- netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394]
- netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394]
- netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746}
- packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537]
- packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582}
- net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537]
- RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856}
- netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860}
- ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270}
- KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794}
* Wed Sep 30 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.62.1.el10_2]
- dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099}
- net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034}
- gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261]
- gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261]
- gve: Use generic power management (Michal Schmidt) [RHEL-219261]
- gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261]
- gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261]
- gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261]
- gve: fix SW coalescing when hw-GRO is used (