# changelog

author: Viktor Ashirov <vashirov@redhat.com> - 3.1.3-2
changelog:
  - Resolves: RHEL-5117 - ns-slapd crash in
    dbmdb_import_prepare_worker_entry()
  - Resolves: RHEL-31959 - [RFE] add plugin origin or source in security's
    log msg info
  - Resolves: RHEL-35241 - ns-slapd crashes in referral mode
  - Resolves: RHEL-61327 - Incomplete messages about replication in the
    errors log.
  - Resolves: RHEL-61353 - dbscan  on replication changelog does not display
    MOD_TYPE
  - Resolves: RHEL-62874 - dsidm: issue when renaming users
  - Resolves: RHEL-65660 - DSIDM: Re-enabling user accounts that reached
    inactivity limit fails with error
  - Resolves: RHEL-67003 - dsconf backend replication monitor fails if
    replica id starts with 0
  - Resolves: RHEL-67006 - dsconf  utility  should let you configure the
    "uniqueness-exclude-subtrees" parameter of the Attribute Uniqueness plug-
    in
  - Resolves: RHEL-67019 - Crash in __strlen_sse2 when using the nsRole
    filter rewriter.
  - Resolves: RHEL-67022 - Password modify extended operation should skip
    password policy checks when executed by root DN
  - Resolves: RHEL-70117 - Unify how group description can be added to a new
    group in WebUI and CLU
  - Resolves: RHEL-74085 - Increased memory consumption caused by NDN cache
  - Resolves: RHEL-74270 - [RFE] Implement "list-dn" option for dsidm tool in
    Directory Server
  - Resolves: RHEL-76832 - Wrong backend database name syntax causes "Red Hat
    Directory Server" => "Databases" menu blank in Cockpit
  - Resolves: RHEL-76837 - dsidm Error: float() argument must be a string or
    a number, not 'NoneType'
  - Resolves: RHEL-76840 - Monitoring tab should use dsconf monitor
  - Resolves: RHEL-77490 - Complete remove the parameter "nsslapd-subtree-
    rename-switch" from DS-12
  - Resolves: RHEL-79080 - Json option does not work with "dsidm account get-
    by-dn" command
  - Resolves: RHEL-80252 - [RFE] Structured (JSON) logging option for RHDS
    access and error logs
  - Resolves: RHEL-80253 - RHDS hangs when having online backup running
    together with automember_rebuild task executing
  - Resolves: RHEL-80497 - Can't rename users member of automember rule
    [rhel-10]
  - Resolves: RHEL-81277 - logconv.py fails when specific timestamps are
    provided
  - Resolves: RHEL-83850 - mdb database statistics don't work
  - Resolves: RHEL-86279 - Cannot create a nested role using "dsidm role
    create-nested"
  - Resolves: RHEL-86280 - Cannot create a filtered role using "dsidm role
    create-filtered"
  - Resolves: RHEL-86313 - RootDN Access Control Plugin with wildcards for IP
    addresses fails with an error "Invalid IP address"
  - Resolves: RHEL-86314 - dsidm failing with error "argument must be a
    string or a number"
  - Resolves: RHEL-86315 - Dsidm get_dn option fails for organizational unit,
    service and posixgroup
  - Resolves: RHEL-86316 - Dsidm uniquegroup members option does not work
  - Resolves: RHEL-86321 - dsidm role rename-by-dn does not rename a role
  - Resolves: RHEL-86322 - dsidm role subtree-status doesn't work
  - Resolves: RHEL-86323 - dsidm role get-by-dn doesn't work properly with -j
    option
  - Resolves: RHEL-86324 - Deleting a role with dsidm results in proper
    deletion message, but role is still present
  - Resolves: RHEL-86785 - dscontainer: support loading custom schema
  - Resolves: RHEL-86878 - segfault at 7ff2370010c8 ip 00007ff2339ba239 sp
    00007fed321fe100 error 6 in liblmdb.so.0.0.0
  - Resolves: RHEL-89748 - Nested group does not receive memberOf attribute
  - Resolves: RHEL-89774 - Improve the "result" field of ipa-healthcheck if
    replicas are busy [rhel-10]
  - Resolves: RHEL-89776 - RHDS12.2 NSMMReplicationPlugin - release_replica
    Unable to parse the response
  - Resolves: RHEL-95441 - ns-slapd[xxxx]: segfault at 10d7d0d0 ip
    00007ff734050cdb sp 00007ff6de9f1430 error 6 in
    libslapd.so.0.1.0[7ff733ec0000+1b3000]
  - Resolves: RHEL-95761 - Improve  error message when bulk import connection
    is closed
  - Resolves: RHEL-97565 - On RHDS 12.6 The user password policy for a user
    was created, but the pwdpolicysubentry attribute for this user
    incorrectly points to the People OU password policy instead of the
    specific user policy.
  - Resolves: RHEL-101926 - ipa-backup failed with error : 'No such file or
    directory: '/usr/sbin/dsctl'


author: Viktor Ashirov <vashirov@redhat.com> - 3.1.3-3
changelog:
  - Resolves: RHEL-80252 - [RFE] Structured (JSON) logging option for RHDS
    access and error logs
  - Resolves: RHEL-95441 - ns-slapd[xxxx]: segfault at 10d7d0d0 ip
    00007ff734050cdb sp 00007ff6de9f1430 error 6 in
    libslapd.so.0.1.0[7ff733ec0000+1b3000]


author: Viktor Ashirov <vashirov@redhat.com> - 3.1.3-4
changelog:
  - Resolves: RHEL-73032 - segfault - error 4 in libpthread-2.28.so
  - Resolves: RHEL-79079 - Failure to get Server monitoring data when NDN
    cache is disabled.
  - Resolves: RHEL-87352 - ns-slapd crashed when we add nsslapd-referral
  - Resolves: RHEL-92054 - Memory leak in
    roles_cache_create_object_from_entry [rhel-10]
  - Resolves: RHEL-107001 - ipa-restore fails to restore SELinux contexts,
    causes ns-slapd AVC denials on /dev/shm after restore. [rhel-10]
  - Resolves: RHEL-107028 - CWE-284 dirsrv log rotation creates files with
    world readable permission
  - Resolves: RHEL-107035 - CWE-532 Created user password hash available to
    see in audit log
  - Resolves: RHEL-107037 - CWE-778 Log doesn't show what user gets password
    changed by administrator


author: Viktor Ashirov <vashirov@redhat.com> - 3.1.3-5
changelog:
  - Resolves: RHEL-101727 - The numSubordinates value is not matching the
    number of direct children.
  - Resolves: RHEL-101783 - RHDS12: Web console doesn't show Server Version
  - Resolves: RHEL-109018 - Allow Uniqueness plugin to search uniqueness
    attributes using custom matching rules
  - Resolves: RHEL-111224 - Error showing local password policy on web UI
  - Resolves: RHEL-112675 - Statistics about index lookup report a wrong
    duration
  - Resolves: RHEL-112689 - Crash if repl keep alive entry can not be created
  - Resolves: RHEL-112722 - Exception thrown by dsconf instance repl get_ruv
  - Resolves: RHEL-113969 - AddressSanitizer: memory leak in
    memberof_add_memberof_attr


author: Viktor Ashirov <vashirov@redhat.com> - 3.2.0-1
changelog:
  - Update to 3.2.0
  - Resolves: RHEL-18041 - [RFE] When there are multiple backends cache auto-
    tune should adapt its tuning
  - Resolves: RHEL-58682 - [RFE]  modify entry cache eviction strategy to
    allow large groups to stay in the cache
  - Resolves: RHEL-64019 - Units for changing MDB max size are not consistent
    across different tools
  - Resolves: RHEL-83274 - Replication online reinitialization of a large
    database gets stalled.
  - Resolves: RHEL-83852 - LDAP high CPU usage while handling indexes with
    IDL scan limit at INT_MAX
  - Resolves: RHEL-86534 - [RFE] Support Dynamic Groups similar to OpenLDAP
  - Resolves: RHEL-89601 - (&(cn:dn:=groups)) no longer returns results
  - Resolves: RHEL-94025 - PAM Pass Through Authentication Plugin processes
    requests for accounts that do not meet the criteria specified in the
    `pamFilter` option.
  - Resolves: RHEL-95395 - Getting "build_candidate_list - Database error 11"
    messages after migrating to LMDB.
  - Resolves: RHEL-96196 - Duplicate/double local password policy entry
    display from redhat directory server webconsole
  - Resolves: RHEL-99331 - [RFE] Need an option with dsconf to delete all the
    conflicts at once instead of deleting each conflict one after the other
  - Resolves: RHEL-105578 - IPA health check up script shows time skew is
    over 24 hours
  - Resolves: RHEL-106502 - Ignore the memberOfDeferredUpdate setting when
    LMDB is used.
  - Resolves: RHEL-106559 - When deferred memberof update is enabled after
    the server crashed it should not launch memberof fixup task by default
  - Resolves: RHEL-106849 - Abort the offline import if the root entry cannot
    be added.
  - Resolves: RHEL-107003 - Improve output dsctl dbverify when backend does
    not exist
  - Resolves: RHEL-109113 - [RFE] memberOf plugin - Add scope for specific
    groups
  - Resolves: RHEL-111219 - Attribute uniqueness is not enforced upon modrdn
    operation
  - Resolves: RHEL-113965 - RetroCL plugin generates invalid LDIF
  - Resolves: RHEL-115179 - Several password related attributes are not
    replicating from the Replicas to the Masters
  - Resolves: RHEL-115484 - ns-slapd crash in libdb, possible memory
    corruption
  - Resolves: RHEL-116060 - Fix paged result search locking
  - Resolves: RHEL-117124 - Missing access JSON logging for TLS/CLient auth
  - Resolves: RHEL-117140 - Changelog trimming - add number of scanned
    entries to the log
  - Resolves: RHEL-117520 - Typo in errors log after a Memberof fixup task.
  - Resolves: RHEL-121208 - [RFE] Make nsslapd-haproxy-trusted-ip accept
    whole subnets
  - Resolves: RHEL-122625 - ipa-healthcheck is complaining about missing or
    incorrectly configured system indexes.
  - Resolves: RHEL-122674 - [WebUI] Replication tab crashes after enabling
    replication as a consumer
  - Resolves: RHEL-123220 - Improve the way to detect asynchronous operations
    in the access logs
  - Resolves: RHEL-123275 - The new ipahealthcheck test
    ipahealthcheck.ds.backends.BackendsCheck raises CRITICAL issue
  - Resolves: RHEL-123663 - Online initialization of consumers fails with
    error -23
  - Resolves: RHEL-123664 - RHDS 12.6 doesn't handle 'ldapsearch' filter with
    space char in DN name correctly
  - Resolves: RHEL-123762 - 389-ds-base OpenScanHub Leaks Detected
  - Resolves: RHEL-124694 - Access logs are not getting deleted as
    configured.
  - Resolves: RHEL-126535 - memory corruption in alias entry plugin
  - Resolves: RHEL-128906 - Scalability issue of replication online
    initialization with large database
  - Resolves: RHEL-129675 - Can't locate CSN error seen in errors log when
    replicating after importing data from ldif files
  - Resolves: RHEL-131129 - ns-slapd[2233]: segfault at 0 ip 00007f1f1d7cd7fc
    sp 00007f1e775fc070 error 4 in libjemalloc.so.2[7f1f1d738000+ac000] on
    389-ds-base-2.6.1-11
  - Resolves: RHEL-133795 - Memory leak observed in ns-slapd with 389-ds-
    base-2.6.1-12
  - Resolves: RHEL-139826 - Rebase 389-ds-base to 3.2.x


author: Viktor Ashirov <vashirov@redhat.com> - 3.2.0-2
changelog:
  - Resolves: RHEL-137786 - Upgrading IDM to latest version: 389-ds-base and
    ipa-server breaks replication


author: Viktor Ashirov <vashirov@redhat.com> - 3.2.0-3
changelog:
  - Bump version to 3.2.0-3
  - Resolves: RHEL-76835 - Web console doesn't show the sub suffix of
    ou=foo,ou=people,dc=example,dc=com.
  - Resolves: RHEL-86320 - [RFE] Support updating/renewing TLS certificate
    without restarting slapd
  - Resolves: RHEL-110192 - ns-slapd doesn't support PQC keys
  - Resolves: RHEL-111220 - RHDS-11.9 dsctl db2index --attr recreates all
    indexes instead of selected ones
  - Resolves: RHEL-111931 - Improve error messages for dsconf localpwp list
  - Resolves: RHEL-121981 - Setting password history count to 0 does not
    flush history
  - Resolves: RHEL-122625 - ipa-healthcheck is complaining about missing or
    incorrectly configured system indexes.
  - Resolves: RHEL-128906 - Scalability issue of replication online
    initialization with large database
  - Resolves: RHEL-137786 - Upgrading IDM to latest version: 389-ds-base and
    ipa-server breaks replication
  - Resolves: RHEL-146769 - Remove memberof_del_dn_from_groups from MemberOf
    plugin


author: Viktor Ashirov <vashirov@redhat.com> - 3.2.0-4
changelog:
  - Bump version to 3.2.0-4
  - Resolves: RHEL-86312 - Crash in trim_changelog() during the Retro
    Changelog trimming.
  - Resolves: RHEL-133085 - Replica installation is failing with message
    MDB_BAD_VALSIZE: Unsupported size of key/DB name/data, or wrong DUPFIXED
  - Resolves: RHEL-137072 - CVE-2025-14905 389-ds-base: 389-ds-base: Remote
    Code Execution and Denial of Service via heap buffer overflow [rhel-10.2]
  - Resolves: RHEL-138729 - Crash ( Segmentation fault ) in
    atomic_compare_exchange()


author: Viktor Ashirov <vashirov@redhat.com> - 3.2.0-6
changelog:
  - Bump version to 3.2.0-6
  - Resolves: RHEL-86312 - Crash in trim_changelog() during the Retro
    Changelog trimming.


author: Viktor Ashirov <vashirov@redhat.com> - 3.2.0-7
changelog:
  - Bump version to 3.2.0-7
  - Resolves: RHEL-170271 - DS 12 does not handle escape char in bind user
    [rhel-10.2.z]
  - Resolves: RHEL-170276 - dnaSharedConfig: "dnaPortNum: 0" [rhel-10.2.z]
  - Resolves: RHEL-170281 - Memory leaks in syncrepl plugin during persistent
    search operations [rhel-10.2.z]
  - Resolves: RHEL-170363 - access log - suspicious wtime  optime negative
    and large values in internal op [rhel-10.2.z]
  - Resolves: RHEL-170478 - An online reinitialization with LMDB is
    terminating the receiving server [rhel-10.2.z]
  - Resolves: RHEL-170481 - dsctl healthcheck DSMOLE0001 inaccurate
    recommendations when there is more than 1 LDAP backend [rhel-10.2.z]
  - Resolves: RHEL-170515 - Possible memory leak when using the Retro
    Changelog plugin. [rhel-10.2.z]
  - Resolves: RHEL-174526 - [RFE] Add OS-level thread names to all server
    threads [rhel-10.2.z]
  - Resolves: RHEL-178074 - CVE-2026-9064 389-ds-base: 389-ds-base: unbounded
    LDAP controls count in get_ldapmessage_controls_ext() causes CPU and heap
    amplification (remote DoS) [rhel-10.2]
  - Resolves: RHEL-180718 - Online export is failing when using the option
    "-s" [rhel-10.2.z]
  - Resolves: RHEL-183897 - Server shutdown during online reindex may lead to
    data loss [rhel-10.2.z]
  - Resolves: RHEL-183898 - Error: NssSsl.add_cert() got an unexpected
    keyword argument 'input_file' [rhel-10.2.z]
  - Resolves: RHEL-183899 - Replication errors in logs [rhel-10.2.z]
  - Resolves: RHEL-183900 - Substring index produces empty results and can
    crash when non-default nsSubStrBegin/nsSubStrEnd lengths are configured
    [rhel-10.2.z]


author: Viktor Ashirov <vashirov@redhat.com> - 3.2.0-8
changelog:
  - Bump version to 3.2.0-8
  - Resolves: RHEL-182152 - CVE-2026-11610 389-ds-base: 389-ds-base: Heap
    buffer overflow in sasl_io_recv() via padded SASL UNBIND [rhel-10.2.z]
  - Resolves: RHEL-183105 - CVE-2026-11774 389-ds-base: 389-ds-base: integer
    overflow in SASL packet length bypasses size limit leading to heap buffer
    overflow [rhel-10.2.z]


author: Al Stone <ahs3@fedoraproject.org> - 20240322-1
changelog:
  - Update source tree to 20240322 version from upstream.  NB: this update
    is done in conjunction with removing s390x support due to the large
    number of patches that are now rendered obsolete.  Closes BZ#2138250.
  - Note, too, that the upstream version of the tarball is missing two
    commits and has the wrong name; discussed this with upstream and
    included a patch with the two commits to correct this, and renamed
    the tarballs to try to maintain consistency. So, upstream is actually
    named version 20240321, but it should be 20240322 according to their
    own git tree (see tag G20240322 on github).
  - Removed executable bit from all the upstream source files
  - Remove big-endian support, aka s390x.  Closes BZ#2298855.
  - Remove several 32-bit only patches that are also obsolete since they
    are for unsupported architectures (thanks to pbonzini and PR#5).
  - Remove PIE patches since that is currently the default (again, thanks
    to pbonzini and PR#5)
  - Resolves: RHEL-66144


author: Neal Gompa <ngompa@fedoraproject.org> - 1.0.2-1
changelog:
  - Update to 1.0.2
  - Clean up some pre-1.0 scriptlet cruft
  - Resolves: RHEL-31497 (Backport latest bulid from Fedora 40)


author: Alessandro Astone <ales.astone@gmail.com> - 1.0.2-2
changelog:
  - Backport patch to fix installing swcatalog
  - Resolves: RHEL-31497 (Backport latest build from Fedora 40)


author: Andreas Schneider <asn@redhat.com> - 1.1.7-1
changelog:
  - Update to version 1.1.7
    * Update ignore list for source tarball generation
    * Added new assert macros to compare 2 double given an epsilon
    * Added meson build system
    * Added header with version to TAP13 output
    * Fixed issues with MSVC
    * Fixed TAP output for skipped tests
    * Fixed issue with fail_msg
    * CMake generated configs for find_package(cmocka)
    * Documentation improvements


author: Jan Friesse <jfriesse@redhat.com> - 3.1.9-2
changelog:
  - Resolves: RHEL-96073

  - exec: Add support for env STATE_DIRECTORY
  - init: Use LogsDirectory in systemd unit file


author: Jan Friesse <jfriesse@redhat.com> - 3.1.10-1.1
changelog:
  - Resolves: RHEL-163802
  - Resolves: RHEL-163823

  - totemsrp: Return error if sanity check fails (fixes CVE-2026-35091)
  - totemsrp: Fix integer overflow in memb_join_sanity (fixes CVE-2026-35092)


author: Ales Nezbeda <anezbeda@redhat.com> - 0.8.8-49
changelog:
  - Fix SPDX license tag based on further research
  - https://gitlab.com/fedora/legal/fedora-license-data/-/issues/396#note_1976038980
  - Related: RHEL-37885


author: Than Ngo <than@redhat.com> - 2:1.12.0-3
changelog:
  - Fix Non-reproducible file names in doxygen output
  - Fix broken markdown links to anchors
  Related: RHEL-58045


author: Milan Crha <mcrha@redhat.com> - 3.52.0-1
changelog:
  - Resolves: RHEL-30204 (Backport Fedora 40 changes)
  - Update to 3.52.0
  - Add patch to allow reconfiguring the dbus-prefix without rebuilding;
    this is needed to make EDS work with the new Flatpak infrastructure.
  - Remove support _eds_dbus_services_prefix - this was only used by
    F38 and earlier Flatpak builds.


author: Parag Nemade <pnemade AT redhat DOT com> - 20230101-14
changelog:
  - Resolves: RHEL-138159
    CVE-2025-15279 GUtils BMP File Parsing Heap-based Buffer Overflow
  - Resolves: RHEL-138144
    CVE-2025-15275 SFD File Parsing Heap-based Buffer Overflow
  - Resolves: RHEL-138126
    CVE-2025-15269 SFD File Parsing Use-After-Free


author: Antonio Torres <antorres@redhat.com> - 3.2.8-2
changelog:
  - Disable JIT if PCRE can't allocate executable memory
  - Fix warnings from service file
    Resolves: RHEL-116594


author: Ondrej Holy <oholy@redhat.com> - 2:3.10.3-8
changelog:
  - Backport several CVE fixes
    Resolves: RHEL-142414, RHEL-142398, RHEL-142382, RHEL-142366, RHEL-142350
    Resolves: RHEL-142334, RHEL-142318


author: Ondrej Holy <oholy@redhat.com> - 2:3.10.3-9
changelog:
  - Backport several CVE fixes
    Resolves: RHEL-147913, RHEL-148817, RHEL-148861, RHEL-148977, RHEL-148894


author: Ondrej Holy <oholy@redhat.com> - 2:3.10.3-11
changelog:
  - Backport several CVE fixes
    Resolves: RHEL-147950, RHEL-147951, RHEL-147966, RHEL-147967, RHEL-147971
    Resolves: RHEL-147997, RHEL-147998, RHEL-148006, RHEL-148007, RHEL-148900
    Resolves: RHEL-148986, RHEL-148989, RHEL-149053, RHEL-155980


author: Ondrej Holy <oholy@redhat.com> - 2:3.10.3-12.2
changelog:
  - Update CLEAR_VBAR_ENTRY size after alloc (CVE-2026-33984)
  - Fail progressive_rfx_quant_sub on invalid values (CVE-2026-33983)
    Resolves: RHEL-162947, RHEL-162963


author: Ondrej Holy <oholy@redhat.com> - 2:3.10.3-12.4
changelog:
  - Fix double free in xf_rail_window_common cleanup (CVE-2026-26986)
  - Fix clipboard use-after-free during auto-reconnect (CVE-2026-25997)
  - Fix heap-buffer-overflow in bitmap_cache_put (CVE-2026-29775)
  - Add DSP format checks (CVE-2026-31884)
  - Fix DSP array bounds checks (CVE-2026-31883)
  - Fix DSP array bounds checks (CVE-2026-31885)
  - Update PERSISTENT_CACHE_ENTRY::size after realloc (CVE-2026-33987)
  - Update CLEAR_GLYPH_ENTRY::count after alloc (CVE-2026-33985)
  - Use winpr_aligned_calloc in persistent cache (CVE-2026-33982)
    Resolves: RHEL-159804, RHEL-159660, RHEL-161034, RHEL-161469
    Resolves: RHEL-161505, RHEL-161072, RHEL-163654, RHEL-168462, RHEL-162931


author: Ondrej Holy <oholy@redhat.com> - 2:3.10.3-12.6
changelog:
  - Backport several CVE fixes (CVE-2026-40033, CVE-2026-44420, CVE-2026-44421,
    CVE-2026-44422, CVE-2026-45700)
    Resolves: RHEL-186978, RHEL-186967, RHEL-186958, RHEL-186950, RHEL-186093


author: RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2:3.10.3-12.7
changelog:
  - Add codecID checks for CACHE_BITMAP_V3_ORDER (CVE-2026-55827)
  - Fix boundary checks in gdi_Bitmap_Decompress (CVE-2026-55827)
    Resolves: RHEL-194327


author: Daan De Meyer <daan.j.demeyer@gmail.com> - 2.7.0-3
changelog:
  - Provide a sysusers.d file to get user() and group() provides
    (see https://fedoraproject.org/wiki/Changes/Adopting_sysusers.d_format).


author: Neal Gompa <ngompa@centosproject.org> - 2.7.2-1
changelog:
  - Update to 2.7.2
    + Backport fixes from upstream to use BeaconDB
    + Use BeaconDB for the default location services source
    Resolves: RHEL-79063


author: Florian Weimer <fweimer@redhat.com> - 2.39-120
changelog:
  - Sync with upstream branch release/2.39/master (RHEL-151554)
  - Upstream commit: 0dc95ae10929aba1cc660e97cfc94903c2568efa
  - resolv: Check hostname for validity (CVE-2026-4438)
  - resolv: Count records correctly (CVE-2026-4437)
  - iconvdata: Fix invalid pointer arithmetic in ANSI_X3.110 module


author: Takao Fujiwara <tfujiwar@redhat.com> - 2018.1-17
changelog:
  - Resolve RHELPLAN-170235 Fix OpenScanHub report
  - Fix deprecated g_spawn_check_exit_status with -Wdeprecated-declarations
  - Fix uninitialized n_failed with -Wanalyzer-use-of-uninitialized-value
  - Fix to check return value of g_setenv() with CWE-252


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.31~beta1-11
changelog:
  - Disable ibus-panel rich condition in RHEL
  - Delete ibus-xx-desktop-testing-mutter.patch
  - Delete libXtst-devel dependency
  - Replace gnome-terminal with ptyxis
  - Install gnome-desktop-testing for RHEL
  - Delete xorg-x11-server-Xvfb gnome-session-xsession
  - Delete build packages for gnome-desktop-testing for RHEL
  - Move evince gnome-logs gvfs-fuse gvfs-gphoto2 gvfs-smb to Fedora specific
  - Fix CI test case conditions
  - Add no-overview@fthx until gnome-shell-extension-no-overview is available
  - Add gnome-headless-session@.service until GDM will provide it


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.31-1
changelog:
  - Bump to 1.5.31
  - Delete RHEL specific packages
  - Update installed packages in CI
  - configure option for Flatpak build
  - Move xinit post scripts
  - Require gnome-shell-extension-no-overview in RHEL


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.8.0.8-0.1.ea
changelog:
  - Update to jdk-21.0.8+8 (EA)
  - Update release notes to 21.0.8+8
  - Sync the copy of the portable specfile with the latest update
  - Resolves: RHEL-101803


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.8.0.9-1
changelog:
  - Update to jdk-21.0.8+9 (GA)
  - Update release notes to 21.0.8+9
  - Switch to GA mode
  - Sync the copy of the portable specfile with the latest update
  - ** This tarball is embargoed until 2025-07-15 @ 1pm PT. **
  - Resolves: RHEL-102295


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.9.0.10-1
changelog:
  - Update to jdk-21.0.9+10 (GA)
  - Update release notes to 21.0.9+10
  - Bump harfbuzz version to 11.2.0 following JDK-8355528
  - Add NEWS corrections from Thomas
  - Use double spacing consistently in notes for this release
  - Correct 11u release reference to corresponding 21u release as pointed out by Kieran
  - Sync the copy of the portable specfile with the latest update
  - ** This tarball is embargoed until 2025-10-21 @ 1pm PT. **
  - Resolves: RHEL-118771
  - Resolves: RHEL-119468


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.9.0.10-2
changelog:
  - Bump rpmrelease for CentOS build
  - Add scripts to handle tagging of portable-based RPMs
  - Related: RHEL-118771
  - Related: RHEL-119468


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.10.0.7-1
changelog:
  - Update to jdk-21.0.10+7 (GA)
  - Update release notes to 21.0.10+7
  - Bump libpng version to 1.6.51 following JDK-8372534
  - Update FIPS patch to include nss.fips.cfg that grants CKA_ENCRYPT
  - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh
  - Sync the copy of the portable specfile with the latest update
  - Resolves: RHEL-142857
  - Resolves: RHEL-139565
  - Resolves: RHEL-131428
  - Resolves: RHEL-131441
  - Resolves: RHEL-142861
  - Resolves: RHEL-142815
  - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. **


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.10.0.7-2
changelog:
  - Bump rpmrelease for CentOS build
  - Related: RHEL-142857
  - Related: RHEL-139565
  - Related: RHEL-131428
  - Related: RHEL-131441
  - Related: RHEL-142861
  - Related: RHEL-142815


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.11.0.10-1
changelog:
  - Update to jdk-21.0.11+10 (GA)
  - Update release notes to 21.0.11+10
  - Update FIPS patch to feef2dc3ca7 version synced with 21.0.11+9 and adapted to JDK-8244336
  - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158
  - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078
  - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047
  - Bump zlib version to 1.3.2 following JDK-8378631
  - Add JDK-8375294 EOPNOTSUPP patch ahead of 21.0.13
  - Sync the copy of the portable specfile with the latest update
  - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. **
  - Resolves: RHEL-169611
  - Resolves: RHEL-133215
  - Resolves: RHEL-146648
  - Resolves: RHEL-148326
  - Resolves: RHEL-148828
  - Resolves: RHEL-157090
  - Resolves: RHEL-161216
  - Resolves: RHEL-161332
  - Resolves: RHEL-169614


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:21.0.11.0.10-1.3
changelog:
  - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm
  - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1
  - Resolves: RHEL-151162


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.12.0.8-1.1
changelog:
  - Update to jdk-21.0.12+8 (GA)
  - Update release notes to 21.0.12+8
  - Bump freetype version to 2.14.3 following JDK-8385390
  - Bump giflib version to 6.1.3 following JDK-8384902
  - Bump HarfBuzz version to 14.2.0 following JDK-8385490
  - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354
  - Bump libpng version to 1.6.58 following JDK-8384495
  - Update tagging scripts to include signature checks and correctly handle gating
  - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3.
  - Add gating scripts to simplify obtaining results and waiving issues
  - Cleanup tagging and gating scripts to appease shellcheck:
  - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg.
  - * scripts/builds/check_signatures.sh: Quote variable usage.
  - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage.
  - * scripts/builds/waive_leapp_issue.sh: Likewise.
  - * scripts/builds/waive_rpminspect.sh: Likewise.
  - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable.
  - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage.
  - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file
  - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field
  - Obsolete old RHEL releases (9.7.0-z, 10.1-z)
  - Make zone string debug output optional in TestTranslations
  - Sync the copy of the portable specfile with the latest update
  - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. **
  - Resolves: RHEL-212302
  - Resolves: RHEL-212303
  - Resolves: RHEL-212304
  - Resolves: RHEL-151191
  - Resolves: RHEL-212305
  - Resolves: RHEL-188872
  - Resolves: RHEL-212306
  - Resolves: RHEL-212307


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.12.0.8-1.2
changelog:
  - Bump release for PQC build
  - Related: RHEL-212302
  - Related: RHEL-212303
  - Related: RHEL-212304
  - Related: RHEL-151191
  - Related: RHEL-212305
  - Related: RHEL-188872
  - Related: RHEL-212306
  - Related: RHEL-212307
  - Related: RHEL-151162


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:25.0.1.0.8-6
changelog:
  - Sync the copy of the portable specfile with the latest update
  - Related: RHEL-133733
  - Related: RHEL-133735


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:25.0.2.0.10-1
changelog:
  - Update to jdk-25.0.2+10 (GA)
  - Update release notes to 25.0.2+10
  - Add JDK-8372534 libpng 1.6.51 ahead of 25.0.3
  - Bump libpng version to 1.6.51 following JDK-8372534
  - Bump ID of NSS adapter patch so we can stay in sync with portable on the libpng patch
  - Test for java.security's existence in create-redhat-properties-files.bash
  - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh
  - Sync the copy of the portable specfile with the latest update
  - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. **
  - Resolves: RHEL-139579
  - Resolves: RHEL-131430
  - Resolves: RHEL-131443
  - Resolves: RHEL-142855
  - Resolves: RHEL-142799


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:25.0.2.0.10-2
changelog:
  - Bump rpmrelease for CentOS build
  - Related: RHEL-139579
  - Related: RHEL-131430
  - Related: RHEL-131443
  - Related: RHEL-142855
  - Related: RHEL-142799


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:25.0.2.0.10-3
changelog:
  - Update FIPS patch to e55ada9353e to include the fix for the too restrictive provider lockdown
  - Fix FIPS issue list to represent the new 25u version
  - Add JDK-8375063 libpng 1.6.54 ahead of 25.0.3
  - Add JDK-8375057 harfbuzz 12.3.2 ahead of 25.0.3
  - Add JDK-8377526 libpng 1.6.55 ahead of 25.0.3
  - Bump libpng version to 1.6.55 following JDK-8375063 & JDK-8377526
  - Bump harfbuzz version to 12.3.2 following JDK-8375057
  - Bump nssadapter version to bring in shared PKCS11 session fix
  - Drop LDFLAGS nssadapter patch which is now upstream in 0.1.1
  - Resolves: RHEL-155000
  - Resolves: RHEL-146649
  - Resolves: RHEL-148327
  - Resolves: RHEL-148830
  - Resolves: RHEL-155044


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:25.0.2.0.10-3
changelog:
  - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm
  - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1
  - Resolves: RHEL-150976


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:25.0.2.0.10-4
changelog:
  - Add tagging scripts with signature checks and gating handling
  - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3.
  - Add gating scripts to simplify obtaining results and waiving issues
  - Sync the copy of the portable specfile with the latest update
  - Resolves: RHEL-155327
  - Resolves: RHEL-155337
  - Resolves: RHEL-155339
  - Related: RHEL-155000
  - Related: RHEL-146649
  - Related: RHEL-148327
  - Related: RHEL-148830


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:25.0.3.0.9-1
changelog:
  - Update to jdk-25.0.3+9 (GA)
  - Update release notes to 25.0.3+9
  - Update FIPS patch to 57722aab802 version synced with 25.0.3+8
  - Drop local libpng patches now JDK-8372534, JDK-8375063 & JDK-8377526 are included upstream
  - Drop local HarfBuzz patch now JDK-8375057 is included upstream
  - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158
  - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078
  - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047
  - Bump zlib version to 1.3.2 following JDK-8378631
  - Bump tzdata version to 2026a following JDK-8379035
  - Add JDK-8375294 EOPNOTSUPP patch ahead of 25.0.4
  - Sync the copy of the portable specfile with the latest update
  - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. **
  - Resolves: RHEL-169620
  - Resolves: RHEL-157091
  - Resolves: RHEL-161217
  - Resolves: RHEL-161333
  - Resolves: RHEL-169613


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:25.0.3.0.9-3.1
changelog:
  - Cleanup tagging and gating scripts to appease shellcheck:
  - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg.
  - * scripts/builds/check_signatures.sh: Quote variable usage.
  - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage.
  - * scripts/builds/waive_leapp_issue.sh: Likewise.
  - * scripts/builds/waive_rpminspect.sh: Likewise.
  - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable.
  - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage.
  - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file
  - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field
  - Add 25u backports of JDK-8347901 & JDK-8378713 C2 performance fixes
  - Sync the copy of the portable specfile with the latest update
  - Related: RHEL-155327
  - Related: RHEL-155339
  - Resolves: RHEL-150977
  - Resolves: RHEL-210972
  - Resolves: RHEL-210993


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:25.0.4.0.7-1.0
changelog:
  - Update to jdk-25.0.4+7 (GA)
  - Update release notes to 25.0.4+7
  - Bump freetype version to 2.14.3 following JDK-8385390
  - Bump giflib version to 6.1.3 following JDK-8384902
  - Bump HarfBuzz version to 14.2.0 following JDK-8385490
  - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354
  - Bump libpng version to 1.6.58 following JDK-8384495
  - Require tzdata 2026b due to upstream inclusion of JDK-8383175
  - Drop local copy of JDK-8375294 EOPNOTSUPP patch
  - Obsolete old RHEL releases (9.7.0-z, 10.1-z)
  - Revert fr_FR and de_DE changes made in d43f0e6186370fdeb0ca2f3594f39783e20eef1c now JDK-8382020 is fixed
  - Simplify TestTranslations run now there is only the CLDR provider and one set of data (JDK-8174269)
  - Make zone string debug output optional in TestTranslations
  - Sync the copy of the portable specfile with the latest update
  - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. **
  - Resolves: RHEL-188883
  - Resolves: RHEL-212294
  - Resolves: RHEL-212296


author: Martin Osvald <mosvald@redhat.com> - 2.6.3-1
changelog:
  - New version 2.6.3
  - Fix for: CVE-2025-32801, CVE-2025-32802, CVE-2025-32803
  - kea.conf: Remove /tmp/ from socket-name for existing configurations
  - kea.conf: Set pseudo-random password for default config to secure fresh
    install and allow CA startup without user intervention
  - kea.conf: Restrict directory permissions
  - Sync service files with upstream
  - Fix leases ownership when switching from root to kea user


author: Martin Osvald <mosvald@redhat.com> - 3.0.0-1
changelog:
  - New version 3.0.0
  - Remove broken keactrl in favor of systemd unit files
  - kea.spec: General cleanup and removal of lines that have no effect
  - kea-msg-compiler was moved from kea to kea-devel


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 1.26-1
changelog:
  - New upstream release
  - Improve TX performance and use less CPU
  - minor other improvements
  - Build system update


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 1.27-1
changelog:
  - New upstream release
  - Fix potential startup race condition (corosync use case)
  - Fix crypto config check
  - Minor API cleanup
  - Test suite fixes


author: Petr Menšík <pemensik@redhat.com> - 1.8.3-15
changelog:
  - Remove unneeded openssl/engine.h causing build failures
  - Explicitly disable openssl engine (RHEL-33736)


author: Fedor Vorobev <fvorobev@redhat.com> - 1.8.3-18.1
changelog:
  - Fix CVE-2026-10846: Off-path poisoning attacks due to insufficient
    query-response matching (RHEL-210690)


author: Dodji Seketeli <dodji@redhat.com> - 2.5-1
changelog:
  - Update to upstream 2.5 tarball
  - Drop patches (as they are now upstream):
    0001-Bug-31045-Don-t-try-setting-translation-unit-for-uni.patch
    0002-suppression-Add-has_strict_flexible_array_data_membe.patch
  - Enable abidb
  - Add BuildRequires: python3-devel
  - Add libabigail.so.4 and libabigail.so.4.0.0 to the RPM


author: Dodji Seketeli <dodji@redhat.com> - 2.6-1
changelog:
  - Update to upstream 2.6 tarball
  - Update to changing SONAME (libabigail.so.5.0.0)
  - Add BuildRequires xxhash-devel


author: Dodji Seketeli <dodji@redhat.com> - 2.8-1
changelog:
  - Update to upstream 2.8 tarball
  - Remove 0001-Fix-fedabipkgdiff-configure-check-for-Python-3.12.patch
    that is applied upstream.
  - Update to changing SONAME (libabigail.so.7.0.0)
  - Add xxhash-devel as BuildRequires and inlined-xxhash to avoid
    depending on it at runtime


author: RHEL Packaging Agent <jotnar@redhat.com> - 2.9-1
changelog:
  - Rebase to upstream 2.9 tarball
  - Update to changing SONAME (libabigail.so.8.0.0)
  - Simplify %check section to run both test targets in single invocation
  - Resolves: RHEL-121667


author: Jerry James <loganjerry@gmail.com> - 3.28.0-1
changelog:
  - Update to 3.28.0
  - Install internal.h for MuseScore
  - Drop ancient obsoletes
  - Build the python package with dist-info
  - Add tables subpackage for the noarch data
  - Complete and correct SPDX migration
  - Remove need for chrpath
  - Minor spec file cleanups


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.10.1.el10_2]
changelog:
  - ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717]
  - ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717]
  - ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717]
  - ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717]
  - ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717]
  - ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717]
  - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.11.1.el10_2]
changelog:
  - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402}
  - KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401}
  - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.12.1.el10_2]
changelog:
  - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354]
  - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354]
  - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354]
  - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354]
  - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354]
  - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354]
  - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354]
  - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724}
  - net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.13.1.el10_2]
changelog:
  - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531]
  - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408}


author: Patrick Talbert <ptalbert@redhat.com> [6.12.0-211.14.1.el10_2]
changelog:
  - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213]
  - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213]
  - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213]
  - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213]
  - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
  - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060}
  - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213]
  - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677}
  - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
  - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213]


author: Patrick Talbert <ptalbert@redhat.com> [6.12.0-211.15.1.el10_2]
changelog:
  - xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.16.1.el10_2]
changelog:
  - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
  - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
  - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333}
  - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128}
  - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.17.1.el10_2]
changelog:
  - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625]
  - redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov)
  - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303}
  - dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205}
  - dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205}
  - mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375}
  - fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617]
  - anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617]
  - pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617]
  - anon_inode: explicitly block ->setattr() (Rafael Aquini) [RHEL-171617]
  - pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617]
  - anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617]
  - ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331]
  - ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331]
  - net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809]
  - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190}
  - netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116}
  - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110}
  - redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944]
  - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051}
  - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027}
  - io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006}
  - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434]
  - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434]
  - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434]
  - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434]
  - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434]
  - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637]
  - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637]
  - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685}
  - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684}
  - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180]
  - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786]
  - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786]
  - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455}
  - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183}
  - can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645}
  - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.18.1.el10_2]
changelog:
  - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
  - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
  - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023}
  - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020}
  - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.19.1.el10_2]
changelog:
  - Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322}
  - Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903]
  - Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903]
  - Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903]
  - Bluetooth: hci_conn: Fix using conn->le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903]
  - Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903]
  - Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903]
  - Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903]
  - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329}
  - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824]
  - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824]
  - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821]
  - dpll: add pin operational state (Ivan Vecera) [RHEL-175821]
  - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827]
  - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827]
  - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827]
  - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827]
  - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709}
  - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277]
  - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277]
  - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277]
  - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277]
  - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837]
  - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837]
  - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837]
  - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930]
  - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930]
  - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930]
  - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930]
  - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930]
  - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930]
  - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930]
  - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930]
  - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302]
  - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366}
  - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653}
  - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653}
  - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.20.1.el10_2]
changelog:
  - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243}
  - redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469]
  - sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950]
  - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613}
  - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.21.1.el10_2]
changelog:
  - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473]
  - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473]
  - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473]
  - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518]
  - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855]
  - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.22.1.el10_2]
changelog:
  - redhat: Fix rebuild changelog generation for automotive (Oleksii Baranov)
  - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932]
  - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932]
  - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932]
  - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932]
  - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932]
  - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932]
  - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932]
  - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932]
  - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932]
  - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932]
  - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932]
  - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932]
  - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932]
  - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932]
  - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932]
  - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932]
  - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932]
  - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932]
  - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932]
  - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932]
  - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932]
  - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932]
  - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932]
  - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932]
  - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932]
  - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932]
  - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932]
  - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932]
  - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
  - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
  - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
  - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
  - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
  - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
  - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
  - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
  - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
  - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
  - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
  - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
  - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
  - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
  - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
  - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
  - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
  - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
  - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
  - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
  - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
  - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
  - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
  - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437]
  - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501}
  - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037}
  - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581}
  - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467}
  - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532}
  - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.24.1.el10_2]
changelog:
  - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319]
  - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723]
  - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127]
  - objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495]
  - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260}
  - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125}
  - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152}
  - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166}
  - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056}
  - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774]
  - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474}
  - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786}
  - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772}
  - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787}
  - rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.25.1.el10_2]
changelog:
  - gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann)
  - redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299]
  - watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299]
  - mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.26.1.el10_2]
changelog:
  - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331}
  - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
  - crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}
  - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.27.1.el10_2]
changelog:
  - nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135}
  - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145}
  - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.28.1.el10_2]
changelog:
  - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117]
  - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198}
  - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414}
  - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117}
  - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898}
  - rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.29.1.el10_2]
changelog:
  - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176}
  - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759]
  - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759]
  - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759]
  - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739}
  - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759]
  - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759]
  - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759]
  - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759]
  - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887]
  - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189}
  - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090}
  - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.30.1.el10_2]
changelog:
  - ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
  - ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
  - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112}
  - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263}
  - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
  - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
  - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263}
  - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
  - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
  - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
  - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537]
  - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537]
  - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537]
  - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537]
  - ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110]
  - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316}
  - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244}
  - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209}
  - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}
  - rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.31.1.el10_2]
changelog:
  - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776]
  - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776]
  - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776]
  - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
  - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776]
  - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776]
  - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776]
  - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
  - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776]
  - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776]
  - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776]
  - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776]
  - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776]
  - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776]
  - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
  - epoll: annotate racy check (Ian Kent) [RHEL-180776]
  - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155}
  - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048]
  - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770]
  - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259}
  - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341}
  - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
  - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
  - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.32.1.el10_2]
changelog:
  - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
  - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
  - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
  - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.33.1.el10_2]
changelog:
  - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}
  - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}
  - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
  - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
  - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.34.1.el10_2]
changelog:
  - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
  - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]
  - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.35.1.el10_2]
changelog:
  - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950}
  - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232]
  - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232]
  - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232]
  - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103]
  - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103]
  - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103]
  - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887]
  - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887]
  - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887]
  - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215}
  - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887]
  - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530}
  - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168}
  - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071}
  - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311]
  - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.36.1.el10_2]
changelog:
  - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
  - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
  - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
  - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
  - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
  - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
  - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
  - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
  - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
  - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
  - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
  - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
  - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
  - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
  - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
  - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
  - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
  - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
  - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
  - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
  - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
  - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
  - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
  - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
  - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
  - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
  - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
  - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
  - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
  - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
  - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
  - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
  - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
  - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
  - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324]
  - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
  - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
  - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
  - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324]
  - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
  - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
  - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
  - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.37.1.el10_2]
changelog:
  - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
  - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.39.1.el10_2]
changelog:
  - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
  - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
  - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
  - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
  - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
  - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
  - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
  - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
  - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
  - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
  - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
  - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
  - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.40.1.el10_2]
changelog:
  - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
  - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
  - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
  - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
  - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
  - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
  - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
  - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
  - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
  - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
  - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
  - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
  - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
  - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
  - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
  - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
  - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
  - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
  - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
  - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
  - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.41.1.el10_2]
changelog:
  - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
  - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.42.1.el10_2]
changelog:
  - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
  - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
  - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.43.1.el10_2]
changelog:
  - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
  - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
  - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
  - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
  - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
  - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
  - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
  - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
  - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
  - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
  - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
  - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
  - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
  - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
  - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
  - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
  - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
  - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
  - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
  - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
  - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
  - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
  - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
  - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
  - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
  - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.44.1.el10_2]
changelog:
  - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
  - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
  - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
  - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
  - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
  - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
  - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
  - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
  - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
  - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
  - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
  - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
  - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
  - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
  - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
  - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
  - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
  - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
  - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
  - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
  - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
  - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
  - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
  - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
  - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
  - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
  - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
  - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
  - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
  - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
  - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
  - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
  - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
  - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
  - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
  - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
  - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
  - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
  - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
  - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
  - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.45.1.el10_2]
changelog:
  - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503]
  - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505]
  - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531}
  - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977}
  - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554}
  - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555}
  - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415}
  - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035]
  - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488}
  - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072}
  - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923}
  - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.46.1.el10_2]
changelog:
  - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368}


author: Fedora Release Engineering <releng@fedoraproject.org> - 2:18.1.2-0.4
changelog:
  - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
  - with python3-Cython -> python3dist(cython) < 3~~


author: Fedora Release Engineering <releng@fedoraproject.org> - 2:18.1.2-0.5
changelog:
  - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
  - revert python3-Cython -> python3dist(cython) < 3~~


author: Kaleb S. KEITHLEY <kkeithle[at]redhat.com> - 2:18.2.1-2
changelog:
  - ceph-18.2.1, incorporate changes from *final* 18.2.1 release from
    https://download.ceph.com/rpm-18.2.1/el9/SRPMS/ceph-18.2.1-0.el9.src.rpm


author: Petr Písař <ppisar@redhat.com> - 0.7.33-3
changelog:
  - Fix a buffer overflow when copying SHA-384/512 checksum from a Debian
    repository (CVE-2026-9150) (RHEL-178263)


author: Petr Písař <ppisar@redhat.com> - 0.7.33-4
changelog:
  - Cope with integer overflow in data size arithmetics in repo_add_solv()
    (CVE-2026-9149) (RHEL-178267)


author: Michal Hlavinka <mhlavink@redhat.com> - 4.6.0-8
changelog:
  - fix CVE-2023-52356: libtiff could crash in TIFFReadRGBATileExt when parsing crafted tiff file (RHEL-148253)


author: Michal Hlavinka <mhlavink@redhat.com> - 4.6.0-8.4
changelog:
  - fix CVE-2026-12912: heap-buffer-overflow in PixarLog 8BITABGR decode with stride 3 (RHEL-189374)
  - make sure documentation is updated during build for CVE-2023-52355 (RHEL-178281)


author: Miro Hrončok <mhroncok@redhat.com> - 2.5.1-6
changelog:
  - Split libmpdec++ into a mpdecimal++ subpackage
  - This prevents packages only using the libmpdec library from transitively depending on libstdc++


author: Charalampos Stratakis <cstratak@redhat.com> - 2.5.1-11
changelog:
  - Fix bind-now annocheck failure by passing the proper LDFLAGS to the C++ library
  Resolves: RHEL-33509


author: Dominik Mierzejewski <rpm@greysector.net> - 2.16.01-1
changelog:
  - update to 2.16.01 (#2155636)
  - drop obsolete patch
  - drop rdoff subpackage (discontinued upstream)


author: Richard W.M. Jones <rjones@redhat.com> - 1.40.0-2
changelog:
  - Rebase to nbdkit 1.40.0
    related: RHEL-49594
  - Send the last error to the NBD client
    resolves: RHEL-50666


author: Richard W.M. Jones <rjones@redhat.com> - 1.44.1-2
changelog:
  - Rebase to nbdkit 1.44.1
    resolves: RHEL-78830, RHEL-101180
  - Synch the spec file with Fedora Rawhide.
  - nbdkit-ondemand-plugin moves into a new subpackage.
  - New nbdkit-count-filter & nbdkit-time-limit-filter.
  - Remove nbdkit-cacheextents-filter.
  - Add extra system call checking and debugging to nbdkit-file-plugin
    resolves: RHEL-85515
  - Allow nbdkit-file-plugin to zero and trim block devices
    resolves: RHEL-89371
  - vddk: Pre-cache the extents for readonly connections
    resolves: RHEL-94825
  - Log filename, offset and count in nbdkit-file-plugin error messages
    resolves: RHEL-95364
  - vddk: Improve statistics
    related: RHEL-94825
  - CVE-2025-47711 denial of service attack by client sending maximum size block
    status
  - CVE-2025-47712 denial of service attack by client sending large unaligned
    size block status
    resolves: RHEL-95819
  - Add support for VDDK 9.0.0.0
    resolves: RHEL-99467
  - server: Fix .zero fallback path
    resolves: RHEL-101636


author: Richard W.M. Jones <rjones@redhat.com> - 1.46.2-1
changelog:
  - Rebase to nbdkit 1.46.2
  - Backport nbdkit_debug_hexdiff, nbdkit_name, nbdkit_timestamp
    from nbdkit 1.47.
    resolves: RHEL-111242
  - Synchronize spec file with Fedora.
  - vddk: Don't use FNM_PATHNAME when matching export parameter
    resolves: RHEL-122755
  - Fix assertion failure in blocksize-policy filter
  - Fix v2v conversion failure when minimum_io_size > 64K
    resolves: RHEL-139390
  - Test and document that VDDK 9.0.1.0 works
    resolves: RHEL-140615


author: Richard W.M. Jones <rjones@redhat.com> - 1.24.1-1
changelog:
  - Rebase to libnbd 1.24.1
    resolves: RHEL-111243
  - Synch spec file with Fedora
  - Fix unsanitized hostnames in nbd+ssh URIs allow remote execution
    resolves: RHEL-129296
  - Implement Post-Quantum Cryptography (PQC)
    resolves: RHEL-101267


author: Ondrej Sloup <osloup@redhat.com> - 1.3.2-74
changelog:
  - Use %{buildroot} instead of $RPM_BUILD_ROOT as it is more recent
  - Use directory macros and push/popd


author: Ondrej Sloup <osloup@redhat.com> - 1.3.2-75
changelog:
  - Fix installation on OSTree by removing %ghost (rhbz#2193429)
  - Remove %ldconfig_postun as it has no effect in Fedora


author: Ondrej Sloup <osloup@redhat.com> - 1.3.2-77
changelog:
  - Sync the RHEL version and Fedora version of the specfile
  - Update sources file and config.{sub|guess}
  - Skip verification for .soc file as it will change after install


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2.7.2-10
changelog:
  - Support added for post-quantum cryptography
    Resolves: RHEL-93091
  - Remove deprecated path from systemd service file
    Resolves: RHEL-101169


author: Nathan Scott <nathans@redhat.com> - 6.3.7-5
changelog:
  - Make pcp-zeroconf start enabled services once again (RHEL-93182)
  - Fix python PMDA wrapper handling of list objects
  - Improve tmpfiles.d handling of empty directories
  - Backport some more fixes to the OpenMetrics PMDA
  - Fix a multilib regression in PCP header files


author: Jitka Plesnikova <jplesnik@redhat.com> - 1.227-1
changelog:
  - Update to 1.227
    - New maintainer, GTERMARS
    - Add basic GitHub Actions setup for testing
    - Typo corrections in POD
    - Eliminated use of state/node files in temp directory


author: Paul Howarth <paul@city-fan.org> - 1.18-1
changelog:
  - Update to 1.18 (rhbz#2251844)
    - Address Freebsd build issue: make function checks more robust within
      shared lib (GH#35)


author: Paul Howarth <paul@city-fan.org> - 1.20-1
changelog:
  - Update to 1.20 (rhbz#2256127)
    - Remove --no-undefined from compiler test, which is not compatible with all
      platforms (GH#37)
    - Skip t/pty_get_winsize.t tests on AIX (GH#32)
    - Fix patchlevel check for util.h (GH#27)


author: Paul Howarth <paul@city-fan.org> - 0.03-48
changelog:
  - Spec tidy-up
    - Use SPDX-format license tag
    - Use author-independent source URL
    - Specify all dependencies
    - Fix permissions verbosely
    - Simplify find commands using -empty and -delete
    - Make %files list more explicit


author: Jindrich Novy <jnovy@redhat.com> - 6:5.6.1-0.1
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.6
    (https://github.com/containers/podman/commit/d46b857)
  - fixes "Can not find network create and rm message from podman event when set --events-backend to journald"
  - Related: RHEL-109790


author: Jindrich Novy <jnovy@redhat.com> - 7:5.6.0-2
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.6-rhel
    (https://github.com/containers/podman/commit/56f1962)
  - fixes "Work on RHEL10.1 packaging"
  - Related: RHEL-80817


author: Jindrich Novy <jnovy@redhat.com> - 7:5.8.1-1
changelog:
  - update to https://github.com/containers/podman/releases/tag/v5.8.1
  - fixes Update Podman to support TLS 1.3 configuration
  - Resolves: RHEL-153732


author: Jindrich Novy <jnovy@redhat.com> - 7:5.8.2-1
changelog:
  - update to https://github.com/containers/podman/releases/tag/v5.8.2
  - fixes CVE-2026-34986 go-jose: Go JOSE Denial of Service via crafted JWE
  - Resolves: RHEL-165012


author: Jindrich Novy <jnovy@redhat.com> - 7:5.8.2-4
changelog:
  - update to the latest state of the sustaining branch
  - fixes CVE-2026-42508 CVE-2026-39829 CVE-2026-39830 CVE-2026-39832 CVE-2026-39835
  - fixes CVE-2026-57231 CVE-2026-25681 CVE-2026-27136
  - Resolves: RHEL-173842 RHEL-185604 RHEL-185920 RHEL-186263 RHEL-188713 RHEL-190073 RHEL-190857 RHEL-191095 RHEL-191546 RHEL-192440


author: Michael Jeanson <mjeanson@efficios.com> - 1.5.11-1
changelog:
  - New upstream release
  - Drop patches merged upstream
  - Add builddep on python3-setuptools for Python 3.12+


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.7.0-8
changelog:
  - dtc-Properly-harden-built-packages.patch [RHEL-33493]
  - Resolves: RHEL-33493
    (Annocheck FAIL: bind-now (dtc))


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.7.0-10
changelog:
  - Fix missing dynamic tags for aarch64 python3 pylibfdt
  - Resolves: RHEL-33493
    (Annocheck FAIL: bind-now (dtc))


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.7.0-12
changelog:
  - dtc-pylibfdt-libfdt.i-Use-SWIG_AppendOutput.patch [RHEL-64318 RHEL-65448]
  - dtc-Disable-problematic-waring-flags.patch [RHEL-64318 RHEL-65448]
  - Resolves: RHEL-64318
    ([RHEL10][CS10] dtc fails to build with Swig 4.3.0)
  - Resolves: RHEL-65448
    ([RHEL10][CS10][FTBFS] dtc fails to build on CS10 and RHEL10)


author: Jan Grulich <jgrulich@redhat.com> - 6.8.1-7
changelog:
  - Sync with Fedora:
    - fix directory ownership
    - install cmake modules for plugins
    - depend on pkgconfig(egl) rather than mesa-libEGL-devel
    Resolves: RHEL-73681


author: Jan Grulich <jgrulich@redhat.com> - 6.10.1-1
changelog:
  - 6.10.1
    Resolves: RHEL-109197
  - QSsl: add support for ML-DSA signature algorithm
    Resolves: RHEL-97008


author: Jan Grulich <jgrulich@redhat.com> - 6.8.1-2
changelog:
  - Make -devel subpkg to require qtbase-private-devel for cmake >= 3.31.0
    Workaround for rhbz#2330219
    Resolves: RHEL-53982


author: Jan Grulich <jgrulich@redhat.com> - 6.10.1-1
changelog:
  - 6.10.1
    Resolves: RHEL-109197
  - Fix CVE-2025-11277 in bundled assimp library
    Resolves: RHEL-120979


author: Pavel Filipenský <pfilipensky@samba.org> - 2:4.23.4-100
changelog:
  - Update to version 4.23.4
  - resolves: RHEL-114545 - Update to version 4.23.4
  - resolves: RHEL-132338 - Fix Time Machine backup
  - resolves: RHEL-132975 - Remove unexpected dependency of libldb to samba


author: Pavel Filipenský <pfilipensky@samba.org> - 2:4.23.5-100
changelog:
  - Update to version 4.23.5
  - resolves: RHEL-138263 - Fix winbind group resolution
  - resolves: RHEL-141012 - Fix winbind crash


author: Pavel Filipenský <pfilipensky@samba.org> - 0:4.23.5-108
changelog:
  - Security release for CVE-2026-1933 CVE-2026-2340  CVE-2026-3012
    CVE-2026-4480 CVE-2026-40170 CVE-2026-4408
  - resolves: RHEL-156279 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba:
    various flaws
  - resolves: RHEL-161644 - CVE-2026-4480 - Fix Samba printing
  - resolves: RHEL-170595 - CVE-2026-40170 - Update bundled ngtcp2
  - resolves: RHEL-166871 - Add stack protection with FORTIFY_SOURCE


author: Andreas Schneider <asn@redhat.com> - 1.4.0-1
changelog:
  - Update to version 1.4.0
    * https://gitlab.com/cwrap/socket_wrapper/-/blob/socket_wrapper-1.4.0/CHANGELOG


author: Jitka Plesnikova <jplesnik@redhat.com> - 4.2.1-1
changelog:
  - Resolves: RHEL-32325
  - 4.2.1 bump
  - Fix gcc's -Wformat-security warning in R Raise function
  - OCaml 5.2.0 ppc64le fix
  - Add support for Python 3.13


author: Andreas Schneider <asn@redhat.com> - 1.3.0-1
changelog:
  - Update to version 1.3.0
    o https://gitlab.com/cwrap/uid_wrapper/-/blob/uid_wrapper-1.3.0/CHANGELOG


