The kABI package contains information pertaining to the AlmaLinux
kernel ABI, including lists of kernel symbols that are needed by
external Linux kernel modules, and a yum plugin to aid enforcement.
Provides
Requires
License
((GPL-2.0-only WITH Linux-syscall-note) OR BSD-2-Clause) AND ((GPL-2.0-only WITH Linux-syscall-note) OR BSD-3-Clause) AND ((GPL-2.0-only WITH Linux-syscall-note) OR CDDL-1.0) AND ((GPL-2.0-only WITH Linux-syscall-note) OR Linux-OpenIB) AND ((GPL-2.0-only WITH Linux-syscall-note) OR MIT) AND ((GPL-2.0-or-later WITH Linux-syscall-note) OR BSD-3-Clause) AND ((GPL-2.0-or-later WITH Linux-syscall-note) OR MIT) AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND BSD-3-Clause-Clear AND GFDL-1.1-no-invariants-or-later AND GPL-1.0-or-later AND (GPL-1.0-or-later OR BSD-3-Clause) AND (GPL-1.0-or-later WITH Linux-syscall-note) AND GPL-2.0-only AND (GPL-2.0-only OR Apache-2.0) AND (GPL-2.0-only OR BSD-2-Clause) AND (GPL-2.0-only OR BSD-3-Clause) AND (GPL-2.0-only OR CDDL-1.0) AND (GPL-2.0-only OR GFDL-1.1-no-invariants-or-later) AND (GPL-2.0-only OR GFDL-1.2-no-invariants-only) AND (GPL-2.0-only WITH Linux-syscall-note) AND GPL-2.0-or-later AND (GPL-2.0-or-later OR BSD-2-Clause) AND (GPL-2.0-or-later OR BSD-3-Clause) AND (GPL-2.0-or-later OR CC-BY-4.0) AND (GPL-2.0-or-later WITH GCC-exception-2.0) AND (GPL-2.0-or-later WITH Linux-syscall-note) AND ISC AND LGPL-2.0-or-later AND (LGPL-2.0-or-later OR BSD-2-Clause) AND (LGPL-2.0-or-later WITH Linux-syscall-note) AND LGPL-2.1-only AND (LGPL-2.1-only OR BSD-2-Clause) AND (LGPL-2.1-only WITH Linux-syscall-note) AND LGPL-2.1-or-later AND (LGPL-2.1-or-later WITH Linux-syscall-note) AND (Linux-OpenIB OR GPL-2.0-only) AND (Linux-OpenIB OR GPL-2.0-only OR BSD-2-Clause) AND Linux-man-pages-copyleft AND MIT AND (MIT OR GPL-2.0-only) AND (MIT OR GPL-2.0-or-later) AND (MIT OR LGPL-2.1-only) AND (MPL-1.1 OR GPL-2.0-only) AND (X11 OR GPL-2.0-only) AND (X11 OR GPL-2.0-or-later) AND Zlib AND (copyleft-next-0.3.1 OR GPL-2.0-or-later)
Changelog
* Thu Nov 05 2026 Andrew Lukoshko <alukoshko@almalinux.org> - 5.14.0-687.66.1
- proc: fix a dentry lock race between release_task and lookup
- hpsa: bring back deprecated PCI ids #CFHack #CFHack2024
- mptsas: bring back deprecated PCI ids #CFHack #CFHack2024
- megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024
- qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024
- qla4xxx: bring back deprecated PCI ids
- lpfc: bring back deprecated PCI ids
- be2iscsi: bring back deprecated PCI ids
- kernel/rh_messages.h: enable all disabled pci devices by moving to
unmaintained
* Thu Nov 05 2026 Eduard Abdullin <eabdullin@almalinux.org> - 5.14.0-687.66.1
- Use AlmaLinux OS secure boot cert
- Debrand for AlmaLinux OS
- Add KVM support for ppc64le
- KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds
* Wed Nov 04 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.66.1.el9_8]
- s390/qeth: validate user buffer length in SNMP and ARP query ioctls (Jan Polensky) [RHEL-295101] {CVE-2026-80584}
- s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-295162] {CVE-2026-80553}
- s390/zcrypt: Validate length for CCA AES cipher key requests (Jan Polensky) [RHEL-297856] {CVE-2026-68452}
- s390/zcrypt: Validate length for CCA ECC private key requests (Jan Polensky) [RHEL-297864] {CVE-2026-68451}
- net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket (Jan Polensky) [RHEL-298271] {CVE-2026-64541}
- sunrpc: wait for in-flight TLS handshake callback when cancel loses race (Olga Kornievskaia) [RHEL-283645] {CVE-2026-72221}
- sunrpc: pin svc_xprt across the asynchronous TLS handshake callback (Olga Kornievskaia) [RHEL-283259] {CVE-2026-72222}
- fs/resctrl: Fix use-after-free during unmount (Dennis Chen) [RHEL-296700] {CVE-2026-72080}
- powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak (Mamatha Inamdar) [RHEL-295113] {CVE-2026-80571}
- s390/boot: Avoid IPL parameter append past command line (Jan Polensky) [RHEL-292349] {CVE-2026-98403}
- s390/boot: Add sized_strscpy() to enable strscpy() usage (Jan Polensky) [RHEL-292349] {CVE-2026-98403}
- sctp: clear new_transport when removing a peer (CKI Backport Bot) [RHEL-275363] {CVE-2026-74586}
- openvswitch: Fix CT limit teardown use-after-free (Timothy Redaelli) [RHEL-263551] {CVE-2026-89488}
- sctp: validate cookie AUTH state before use (Xin Long) [RHEL-254284] {CVE-2026-74752}
- sctp: stop processing a packet once its association is deleted (Xin Long) [RHEL-263317] {CVE-2026-89479}
- sctp: avoid auth_enable sysctl UAF during netns teardown (Xin Long) [RHEL-258776] {CVE-2026-68162}
- sctp: keep chunk->transport in step with the list it is queued on (Xin Long) [RHEL-254364] {CVE-2026-74588}
* Mon Nov 02 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.65.1.el9_8]
- ethtool: cmis: require exact CDB reply length (CKI Backport Bot) [RHEL-229677] {CVE-2026-63996}
- ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES (CKI Backport Bot) [RHEL-227145] {CVE-2026-63987}
* Sat Oct 31 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.64.1.el9_8]
- ipv4: free inet_opt and ireq_opt after an RCU grace period (CKI Backport Bot) [RHEL-295635] {CVE-2026-98432}
- nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() (Maurizio Lombardi) [RHEL-290719] {CVE-2026-98725}
- spi: fsl-lpspi: terminate the RX channel on TX prepare failure path (Iker Pedrosa) [RHEL-234297] {CVE-2026-64303}
- spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() (Iker Pedrosa) [RHEL-234297] {CVE-2026-64303}
- xfrm: hold net_device reference under RCU in bundle creation (Abhishek Rawal) [RHEL-277984] {CVE-2026-98364}
- entry: Fix seccomp bypass after ptrace with TSYNC (Audra Mitchell) [RHEL-271399] {CVE-2026-89603}
- smb: client: bound dirent name against end of SMB response in cifs_filldir (CKI Backport Bot) [RHEL-278331] {CVE-2026-93787}
- sctp: stream: fully roll back denied add-stream state (CKI Backport Bot) [RHEL-277123] {CVE-2026-52929}
- tipc: require net admin for TIPCv2 netlink mutators (CKI Backport Bot) [RHEL-273181] {CVE-2026-74283}
- Bluetooth: mgmt: fix UAF in pair command cancellation (CKI Backport Bot) [RHEL-254650] {CVE-2026-74510}
- ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225993] {CVE-2026-53270}
* Thu Oct 29 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.63.1.el9_8]
- net: skbuff: propagate shared-frag marker in skb_zerocopy() (Xin Long) [RHEL-291166]
- selftests: netfilter: use KHDR_INCLUDES in CFLAGS (Phil Sutter) [RHEL-291352]
- selftests: netfilter: run conntrack_dump_flush in netns (Phil Sutter) [RHEL-291352]
- netfilter: conntrack: make filtering by zone discoverable (Phil Sutter) [RHEL-291352]
- selftests: netfilter: conntrack_dump_flush: remove unused variables and fix typo (Phil Sutter) [RHEL-291352]
- selftests: netfilter: Fix missing return values in conntrack_dump_flush (Phil Sutter) [RHEL-291352]
- selftests: netfilter: remove unused parameter (Phil Sutter) [RHEL-291352]
- selftests: netfilter: Add missing return value (Phil Sutter) [RHEL-291352]
- selftests: netfilter: fix conntrack_dump_flush retval on unsupported kernel (Phil Sutter) [RHEL-291352]
- netfilter: report NLM_F_DUMP_FILTERED when all is filtered out (Phil Sutter) [RHEL-291352]
- netfilter: ctnetlink: fix filtering for zone 0 (Phil Sutter) [RHEL-291352]
- netfilter: ctnetlink: support filtering by zone (Phil Sutter) [RHEL-291352]
- KVM: arm64: Transfer the hyp stack pages out of the host stage-2 (CKI Backport Bot) [RHEL-287053] {CVE-2026-98466}
- mptcp: pm: userspace: fix use-after-free in get_local_id (Prasenjit Mukherjee) [RHEL-236687] {CVE-2026-68169}
- mptcp: options: reset DSS fields in case of unexpected size (Prasenjit Mukherjee) [RHEL-250609] {CVE-2026-80586}
- blk-throttle: fix throtl_data leak during disk release (David Jeffery) [RHEL-250378]
- blk-throttle: fix access race during throttle policy activation (David Jeffery) [RHEL-250378]
* Wed Oct 28 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.62.1.el9_8]
- virtio-fs: avoid double-free on failed queue setup (Miklos Szeredi) [RHEL-278131] {CVE-2026-93827}
- sched/fair: Proportional newidle balance (Herton R. Krzesinski) [RHEL-288067]
- sched/fair: Small cleanup to update_newidle_cost() (Herton R. Krzesinski) [RHEL-288067]
- sched/fair: Small cleanup to sched_balance_newidle() (Herton R. Krzesinski) [RHEL-288067]
- sched/fair: Revert max_newidle_lb_cost bump (Herton R. Krzesinski) [RHEL-288067]
- scsi: target: iscsi: Reserve a terminator byte for the login payload (CKI Backport Bot) [RHEL-285602] {CVE-2026-90011}
- scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (CKI Backport Bot) [RHEL-283505] {CVE-2026-72083}
- arp: do not assume dev_hard_header() does not change skb->head (Guillaume Nault) [RHEL-271130]
- ip6_gre: make ip6gre_header() robust (Guillaume Nault) [RHEL-271130]
- ipv4: ip_gre: make ipgre_header() robust (Guillaume Nault) [RHEL-271127]
- packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244551]
- packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244551] {CVE-2026-74582}
- net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244551]
- ipv6: sit: reload inner IPv6 header after GSO offloads (CKI Backport Bot) [RHEL-225916] {CVE-2026-53228}
* Mon Oct 26 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.61.1.el9_8]
- netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320}
- vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777}
- md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262}
- KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222}
- KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515}
- smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205]
- smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205]
- smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174}
- smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175}
- smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205]
- smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558}
- smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556}
- smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557}
- smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205]
- cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205]
- smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124}
- smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125}
- smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205]
- smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205]
- smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205]
- smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126}
- smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127}
- cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205]
- cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640}
- cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642}
- cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641}
- smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205]
- smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205]
- smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205]
- smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205]
- cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205]
- cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205]
- cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205]
- cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639}
- cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205]
- smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205]
- smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794}
- smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205]
- smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205]
- smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205]
- smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205]
- smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205]
- smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205]
- smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801}
- smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205]
- smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205]
- smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205]
- smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205]
- smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205]
- smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205]
- smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205]
- smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829}
- cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205]
- cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205]
- cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205]
- smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205]
- smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205]
- smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362}
- smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205]
- cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205]
- cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205]
- cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205]
- cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205]
- udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974}
- smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638}
- net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978}
- net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134]
- net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979}
- net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523}
- fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388}
- fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388}
- fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388}
- ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476}
- selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242}
- usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824}
- fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2