# changelog

author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [4.18.0-553.143.1.el8_10]
changelog:
  - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193334] {CVE-2026-53166}
  - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499}


author: Jan Stancek <jstancek@redhat.com> [4.18.0-553.144.1.el8_10]
changelog:
  - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180170] {CVE-2026-46116}
  - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193938]
  - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179325] {CVE-2026-46086}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [4.18.0-553.145.1.el8_10]
changelog:
  - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188327] {CVE-2026-53071}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [4.18.0-553.146.1.el8_10]
changelog:
  - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117}
  - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [4.18.0-553.147.1.el8_10]
changelog:
  - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807}
  - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341]
  - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341]
  - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341]
  - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341]
  - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341]
  - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026}
  - KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228]
  - KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228]
  - KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228]
  - KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228]
  - serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191]
  - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993}
  - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324]
  - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059}
  - xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174]
  - selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738]
  - selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738]
  - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738]
  - mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655]
  - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655]
  - mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655]


author: Release Engineering <releng@rockylinux.org> - 4.18.0-553.147.1
changelog:
  - Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
  - Adding Rocky secure boot certs (Sherif Nagy)
  - Fixing vmlinuz removal (Sherif Nagy)
  - Fixing UEFI CA path (Sherif Nagy)
  - Porting to 8.10, debranding and Rocky branding (Louis Abel)
  - Fixing pesign_key_name values (Sherif Nagy)


author: RESF Sideline (Backporter) <releng+sideline@rockylinux.org> - 4.18.0-553.147.1
changelog:
  - fbf6449f84bf x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach (nhanlon)
  - 3e3255265291 x86/boot: Move x86_cache_alignment initialization to correct spot (nhanlon)


author: Jonathan Maple (Backporter) <jmaple@ciq.com> - 4.18.0-553.147.1
changelog:
  - 2a38e4ca3022 - Dave Hansen - 2024-05-30 - x86/cpu: Provide default cache line size if not enumerated
  - 95bfb35269b2 - Borislav Petkov (AMD) - 2024-03-21 - x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes()
  - 9a458198eba9 - Paolo Bonzini - 2024-02-26 - x86/cpu: Allow reducing x86_phys_bits during early_identify_cpu()


