# changelog

author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.5.1.el9_8]
changelog:
  - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672]
  - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672]
  - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243}
  - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109}
  - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.6.1.el9_8]
changelog:
  - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402}
  - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741}
  - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988]
  - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378]
  - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966]
  - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966]
  - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966]
  - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966]
  - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966]
  - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966]
  - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966]
  - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966]
  - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966]
  - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966]
  - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966]
  - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207]
  - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095]
  - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
  - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
  - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.7.1.el9_8]
changelog:
  - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
  - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
  - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
  - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
  - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
  - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
  - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
  - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
  - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
  - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
  - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
  - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
  - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
  - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
  - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
  - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
  - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
  - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
  - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]


author: Patrick Talbert <ptalbert@redhat.com> [5.14.0-687.8.1.el9_8]
changelog:
  - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
  - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
  - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
  - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
  - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
  - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
  - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
  - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
  - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
  - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]


author: Patrick Talbert <ptalbert@redhat.com> [5.14.0-687.9.1.el9_8]
changelog:
  - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.10.1.el9_8]
changelog:
  - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
  - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
  - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
  - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
  - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
  - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
  - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
  - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.11.1.el9_8]
changelog:
  - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
  - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
  - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
  - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
  - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
  - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
  - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
  - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
  - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
  - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
  - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
  - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
  - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
  - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
  - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
  - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
  - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
  - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
  - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
  - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
  - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
  - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
  - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
  - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
  - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
  - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
  - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
  - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
  - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
  - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
  - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
  - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
  - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
  - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
  - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
  - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
  - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
  - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
  - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
  - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
  - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
  - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
  - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
  - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
  - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.12.1.el9_8]
changelog:
  - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
  - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
  - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
  - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
  - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
  - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
  - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
  - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
  - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
  - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]


author: Release Engineering <releng@rockylinux.org> - 5.14.0-687.12.1
changelog:
  - Replace sbat with Rocky Linux sbat (label)
  - Change bug tracker URL (label)
  - Ensure appended release in sbat is removed


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.23.1.el9_8]
changelog:
  - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
  - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
  - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773]
  - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
  - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
  - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
  - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
  - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
  - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
  - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
  - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
  - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
  - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
  - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
  - epoll: annotate racy check (Ian Kent) [RHEL-180773]
  - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
  - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.24.1.el9_8]
changelog:
  - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
  - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
  - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.25.1.el9_8]
changelog:
  - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
  - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
  - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
  - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
  - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
  - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
  - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
  - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
  - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.27.1.el9_8]
changelog:
  - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886]
  - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886]
  - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886]
  - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215}
  - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886]
  - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113}
  - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943]
  - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110}
  - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121]
  - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121]
  - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121]
  - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121]
  - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121]
  - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121]
  - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121]
  - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121]
  - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121]
  - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121]
  - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121]
  - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121]
  - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121]
  - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121]
  - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121]
  - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121]
  - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121]
  - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121]
  - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121]
  - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121]
  - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121]
  - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121]
  - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121]
  - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121]
  - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121]
  - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121]
  - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121]
  - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121]
  - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121]
  - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121]
  - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121]
  - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121]
  - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121]
  - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121]
  - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071}
  - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980]
  - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.28.1.el9_8]
changelog:
  - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.29.1.el9_8]
changelog:
  - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685]
  - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061]
  - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099}
  - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.30.1.el9_8]
changelog:
  - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807}
  - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468]
  - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468]
  - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468]
  - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277]
  - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026}
  - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412]
  - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950}
  - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950}
  - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950}
  - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950}
  - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006}
  - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976}
  - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.31.1.el9_8]
changelog:
  - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017}
  - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017}
  - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973}
  - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729]
  - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729]
  - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729]
  - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729]
  - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729]
  - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729]
  - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729]
  - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729]
  - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729]
  - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729]
  - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729]
  - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729]
  - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797}
  - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797}
  - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281}
  - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342]
  - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002}
  - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257]
  - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.33.1.el9_8]
changelog:
  - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530}
  - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.34.1.el9_8]
changelog:
  - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430]
  - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471]
  - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021]
  - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214}
  - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.35.1.el9_8]
changelog:
  - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331]
  - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331]
  - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331]
  - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331]
  - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331]
  - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331]
  - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.36.1.el9_8]
changelog:
  - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575]
  - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575]
  - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058]
  - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058]
  - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058]
  - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977}
  - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554}
  - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555}
  - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415}


