Kernel-cross-headers includes the C header files that specify the interface
between the Linux kernel and userspace libraries and programs. The
header files define structures and constants that are needed for
building most standard programs and are also needed for rebuilding the
cross-glibc package.
Provides
Requires
License
((GPL-2.0-only WITH Linux-syscall-note) OR BSD-2-Clause) AND ((GPL-2.0-only WITH Linux-syscall-note) OR BSD-3-Clause) AND ((GPL-2.0-only WITH Linux-syscall-note) OR CDDL-1.0) AND ((GPL-2.0-only WITH Linux-syscall-note) OR Linux-OpenIB) AND ((GPL-2.0-only WITH Linux-syscall-note) OR MIT) AND ((GPL-2.0-or-later WITH Linux-syscall-note) OR BSD-3-Clause) AND ((GPL-2.0-or-later WITH Linux-syscall-note) OR MIT) AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND BSD-3-Clause-Clear AND GFDL-1.1-no-invariants-or-later AND GPL-1.0-or-later AND (GPL-1.0-or-later OR BSD-3-Clause) AND (GPL-1.0-or-later WITH Linux-syscall-note) AND GPL-2.0-only AND (GPL-2.0-only OR Apache-2.0) AND (GPL-2.0-only OR BSD-2-Clause) AND (GPL-2.0-only OR BSD-3-Clause) AND (GPL-2.0-only OR CDDL-1.0) AND (GPL-2.0-only OR GFDL-1.1-no-invariants-or-later) AND (GPL-2.0-only OR GFDL-1.2-no-invariants-only) AND (GPL-2.0-only WITH Linux-syscall-note) AND GPL-2.0-or-later AND (GPL-2.0-or-later OR BSD-2-Clause) AND (GPL-2.0-or-later OR BSD-3-Clause) AND (GPL-2.0-or-later OR CC-BY-4.0) AND (GPL-2.0-or-later WITH GCC-exception-2.0) AND (GPL-2.0-or-later WITH Linux-syscall-note) AND ISC AND LGPL-2.0-or-later AND (LGPL-2.0-or-later OR BSD-2-Clause) AND (LGPL-2.0-or-later WITH Linux-syscall-note) AND LGPL-2.1-only AND (LGPL-2.1-only OR BSD-2-Clause) AND (LGPL-2.1-only WITH Linux-syscall-note) AND LGPL-2.1-or-later AND (LGPL-2.1-or-later WITH Linux-syscall-note) AND (Linux-OpenIB OR GPL-2.0-only) AND (Linux-OpenIB OR GPL-2.0-only OR BSD-2-Clause) AND Linux-man-pages-copyleft AND MIT AND (MIT OR GPL-2.0-only) AND (MIT OR GPL-2.0-or-later) AND (MIT OR LGPL-2.1-only) AND (MPL-1.1 OR GPL-2.0-only) AND (X11 OR GPL-2.0-only) AND (X11 OR GPL-2.0-or-later) AND Zlib AND (copyleft-next-0.3.1 OR GPL-2.0-or-later)
Changelog
* Mon Nov 02 2026 Andrew Lukoshko <alukoshko@almalinux.org> - 5.14.0-687.65.1
- proc: fix a dentry lock race between release_task and lookup
- hpsa: bring back deprecated PCI ids #CFHack #CFHack2024
- mptsas: bring back deprecated PCI ids #CFHack #CFHack2024
- megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024
- qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024
- qla4xxx: bring back deprecated PCI ids
- lpfc: bring back deprecated PCI ids
- be2iscsi: bring back deprecated PCI ids
- kernel/rh_messages.h: enable all disabled pci devices by moving to
unmaintained
* Mon Nov 02 2026 Eduard Abdullin <eabdullin@almalinux.org> - 5.14.0-687.65.1
- Use AlmaLinux OS secure boot cert
- Debrand for AlmaLinux OS
- Add KVM support for ppc64le
- KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds
* Mon Nov 02 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.65.1.el9_8]
- ethtool: cmis: require exact CDB reply length (CKI Backport Bot) [RHEL-229677] {CVE-2026-63996}
- ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES (CKI Backport Bot) [RHEL-227145] {CVE-2026-63987}
* Sat Oct 31 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.64.1.el9_8]
- ipv4: free inet_opt and ireq_opt after an RCU grace period (CKI Backport Bot) [RHEL-295635] {CVE-2026-98432}
- nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() (Maurizio Lombardi) [RHEL-290719] {CVE-2026-98725}
- spi: fsl-lpspi: terminate the RX channel on TX prepare failure path (Iker Pedrosa) [RHEL-234297] {CVE-2026-64303}
- spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() (Iker Pedrosa) [RHEL-234297] {CVE-2026-64303}
- xfrm: hold net_device reference under RCU in bundle creation (Abhishek Rawal) [RHEL-277984] {CVE-2026-98364}
- entry: Fix seccomp bypass after ptrace with TSYNC (Audra Mitchell) [RHEL-271399] {CVE-2026-89603}
- smb: client: bound dirent name against end of SMB response in cifs_filldir (CKI Backport Bot) [RHEL-278331] {CVE-2026-93787}
- sctp: stream: fully roll back denied add-stream state (CKI Backport Bot) [RHEL-277123] {CVE-2026-52929}
- tipc: require net admin for TIPCv2 netlink mutators (CKI Backport Bot) [RHEL-273181] {CVE-2026-74283}
- Bluetooth: mgmt: fix UAF in pair command cancellation (CKI Backport Bot) [RHEL-254650] {CVE-2026-74510}
- ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225993] {CVE-2026-53270}
* Thu Oct 29 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.63.1.el9_8]
- net: skbuff: propagate shared-frag marker in skb_zerocopy() (Xin Long) [RHEL-291166]
- selftests: netfilter: use KHDR_INCLUDES in CFLAGS (Phil Sutter) [RHEL-291352]
- selftests: netfilter: run conntrack_dump_flush in netns (Phil Sutter) [RHEL-291352]
- netfilter: conntrack: make filtering by zone discoverable (Phil Sutter) [RHEL-291352]
- selftests: netfilter: conntrack_dump_flush: remove unused variables and fix typo (Phil Sutter) [RHEL-291352]
- selftests: netfilter: Fix missing return values in conntrack_dump_flush (Phil Sutter) [RHEL-291352]
- selftests: netfilter: remove unused parameter (Phil Sutter) [RHEL-291352]
- selftests: netfilter: Add missing return value (Phil Sutter) [RHEL-291352]
- selftests: netfilter: fix conntrack_dump_flush retval on unsupported kernel (Phil Sutter) [RHEL-291352]
- netfilter: report NLM_F_DUMP_FILTERED when all is filtered out (Phil Sutter) [RHEL-291352]
- netfilter: ctnetlink: fix filtering for zone 0 (Phil Sutter) [RHEL-291352]
- netfilter: ctnetlink: support filtering by zone (Phil Sutter) [RHEL-291352]
- KVM: arm64: Transfer the hyp stack pages out of the host stage-2 (CKI Backport Bot) [RHEL-287053] {CVE-2026-98466}
- mptcp: pm: userspace: fix use-after-free in get_local_id (Prasenjit Mukherjee) [RHEL-236687] {CVE-2026-68169}
- mptcp: options: reset DSS fields in case of unexpected size (Prasenjit Mukherjee) [RHEL-250609] {CVE-2026-80586}
- blk-throttle: fix throtl_data leak during disk release (David Jeffery) [RHEL-250378]
- blk-throttle: fix access race during throttle policy activation (David Jeffery) [RHEL-250378]
* Wed Oct 28 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.62.1.el9_8]
- virtio-fs: avoid double-free on failed queue setup (Miklos Szeredi) [RHEL-278131] {CVE-2026-93827}
- sched/fair: Proportional newidle balance (Herton R. Krzesinski) [RHEL-288067]
- sched/fair: Small cleanup to update_newidle_cost() (Herton R. Krzesinski) [RHEL-288067]
- sched/fair: Small cleanup to sched_balance_newidle() (Herton R. Krzesinski) [RHEL-288067]
- sched/fair: Revert max_newidle_lb_cost bump (Herton R. Krzesinski) [RHEL-288067]
- scsi: target: iscsi: Reserve a terminator byte for the login payload (CKI Backport Bot) [RHEL-285602] {CVE-2026-90011}
- scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (CKI Backport Bot) [RHEL-283505] {CVE-2026-72083}
- arp: do not assume dev_hard_header() does not change skb->head (Guillaume Nault) [RHEL-271130]
- ip6_gre: make ip6gre_header() robust (Guillaume Nault) [RHEL-271130]
- ipv4: ip_gre: make ipgre_header() robust (Guillaume Nault) [RHEL-271127]
- packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244551]
- packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244551] {CVE-2026-74582}
- net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244551]
- ipv6: sit: reload inner IPv6 header after GSO offloads (CKI Backport Bot) [RHEL-225916] {CVE-2026-53228}
* Mon Oct 26 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.61.1.el9_8]
- netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320}
- vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777}
- md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262}
- KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222}
- KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515}
- smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205]
- smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205]
- smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174}
- smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175}
- smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205]
- smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558}
- smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556}
- smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557}
- smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205]
- cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205]
- smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124}
- smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125}
- smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205]
- smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205]
- smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205]
- smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126}
- smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127}
- cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205]
- cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640}
- cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642}
- cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641}
- smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205]
- smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205]
- smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205]
- smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205]
- cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205]
- cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205]
- cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205]
- cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639}
- cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205]
- smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205]
- smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794}
- smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205]
- smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205]
- smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205]
- smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205]
- smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205]
- smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205]
- smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801}
- smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205]
- smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205]
- smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205]
- smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205]
- smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205]
- smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205]
- smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205]
- smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829}
- cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205]
- cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205]
- cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205]
- smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205]
- smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205]
- smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362}
- smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205]
- cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205]
- cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205]
- cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205]
- cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205]
- udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974}
- smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638}
- net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978}
- net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134]
- net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979}
- net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523}
- fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388}
- fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388}
- fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388}
- ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476}
- selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242}
- usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824}
- fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266}
* Wed Oct 21 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.60.1.el9_8]
- xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536}
- ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448}
- ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202}
- calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147}
- calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147}
- netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063}
- xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530}
- vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299}
- ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481}
- rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029]
* Fri Oct 16 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.59.1.el9_8]
- net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987]
- ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999}
- smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631}
- exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260}
- perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817}
- smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633}
- strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747]
- xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697]
- xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697]
- xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697]
- bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032}
- net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528]
- tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024}
- ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572}
- inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590}
- ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114}
- usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958}
- usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429]
- usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962}
- usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963}
- usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961}
- USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956}
- USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957}
- USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928}
- USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899}
- Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509}
- openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678}
- openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678}
- Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974}
- Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974}
- xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935}
* Wed Oct 14 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.58.1.el9_8]
- net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985}
- net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985}
- net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985}
- KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288}
- SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207}
- svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228}
- NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036}
- NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659}
- svcrdma: Validate Read chunk po