# changelog

author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.29.1.el9_7]
changelog:
  - squashfs: fix memory leak in squashfs_fill_super (Abhi Das) [RHEL-138015] {CVE-2025-38415}
  - Squashfs: check return result of sb_min_blocksize (CKI Backport Bot) [RHEL-138015] {CVE-2025-38415}
  - usb: core: config: Prevent OOB read in SS endpoint companion parsing (CKI Backport Bot) [RHEL-137364] {CVE-2025-39760}
  - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (CKI Backport Bot) [RHEL-137069] {CVE-2025-38024}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.30.1.el9_7]
changelog:
  - io_uring/net: commit partial buffers on retry (Jeff Moyer) [RHEL-137329] {CVE-2025-38730}
  - io_uring/kbuf: add io_kbuf_commit() helper (Jeff Moyer) [RHEL-137329]
  - io_uring/kbuf: use 'bl' directly rather than req->buf_list (Jeff Moyer) [RHEL-137329]
  - ice: prevent NULL deref in ice_lag_move_new_vf_nodes() (Michal Schmidt) [RHEL-143296]
  - net: openvswitch: Avoid needlessly taking the RTNL on vport destroy (Adrian Moreno) [RHEL-141404]
  - atm: clip: Fix infinite recursive call of clip_push(). (Guillaume Nault) [RHEL-137601] {CVE-2025-38459}
  - dpll: zl3073x: Remove unused dev wrappers (Ivan Vecera) [RHEL-139699]
  - dpll: zl3073x: Cache all output properties in zl3073x_out (Ivan Vecera) [RHEL-139699]
  - dpll: zl3073x: Cache all reference properties in zl3073x_ref (Ivan Vecera) [RHEL-139699]
  - dpll: zl3073x: Cache reference monitor status (Ivan Vecera) [RHEL-139699]
  - dpll: zl3073x: Split ref, out, and synth logic from core (Ivan Vecera) [RHEL-139699]
  - dpll: zl3073x: Store raw register values instead of parsed state (Ivan Vecera) [RHEL-139699]
  - dpll: fix device-id-get and pin-id-get to return errors properly (Ivan Vecera) [RHEL-139699]
  - dpll: spec: add missing module-name and clock-id to pin-get reply (Ivan Vecera) [RHEL-139699]
  - dpll: zl3073x: Allow to configure phase offset averaging factor (Ivan Vecera) [RHEL-139699]
  - dpll: add phase_offset_avg_factor_get/set callback ops (Ivan Vecera) [RHEL-139699]
  - dpll: add phase-offset-avg-factor device attribute to netlink spec (Ivan Vecera) [RHEL-139699]
  - dpll: fix clock quality level reporting (Ivan Vecera) [RHEL-139699]
  - dpll: add reference sync get/set (Ivan Vecera) [RHEL-139699]
  - dpll: add reference-sync netlink attribute (Ivan Vecera) [RHEL-139699]
  - dpll: remove documentation of rclk_dev_name (Ivan Vecera) [RHEL-139699]
  - net: use dst_dev_rcu() in sk_setup_caps() (Hangbin Liu) [RHEL-129084] {CVE-2025-40170}
  - ipv4: use RCU protection in ip_dst_mtu_maybe_forward() (Hangbin Liu) [RHEL-129084]
  - net: ipv4: Consolidate ipv4_mtu and ip_dst_mtu_maybe_forward (Hangbin Liu) [RHEL-129084]
  - ipv6: use RCU in ip6_xmit() (Hangbin Liu) [RHEL-129018] {CVE-2025-40135}
  - ipv6: use RCU in ip6_output() (Hangbin Liu) [RHEL-128982] {CVE-2025-40158}
  - net: dst: introduce dst->dev_rcu (Hangbin Liu) [RHEL-128982]
  - ipv4: use RCU protection in __ip_rt_update_pmtu() (Hangbin Liu) [RHEL-128982]
  - net: Add locking to protect skb->dev access in ip_output (Hangbin Liu) [RHEL-128982]
  - net: dst: add four helpers to annotate data-races around dst->dev (Hangbin Liu) [RHEL-128982]
  - bpf: Fix mismatched RCU unlock flavour in bpf_out_neigh_v6 (Hangbin Liu) [RHEL-128982]
  - vrf: Fix lockdep splat in output path (Hangbin Liu) [RHEL-128982]
  - ipv6: remove nexthop_fib6_nh_bh() (Hangbin Liu) [RHEL-128982]
  - net: remove rcu_dereference_bh_rtnl() (Hangbin Liu) [RHEL-128982]
  - neighbour: switch to standard rcu, instead of rcu_bh (Hangbin Liu) [RHEL-128982]
  - ipv6: flowlabel: do not disable BH where not needed (Hangbin Liu) [RHEL-128982]
  - ipv6: remove one read_lock()/read_unlock() pair in rt6_check_neigh() (Hangbin Liu) [RHEL-128982]
  - neigh: introduce neigh_confirm() helper function (Hangbin Liu) [RHEL-128982]
  - net: bonding: update the slave array for broadcast mode (Hangbin Liu) [RHEL-132923]
  - net: bonding: add broadcast_neighbor netlink option (Hangbin Liu) [RHEL-132923]
  - net: bonding: add broadcast_neighbor option for 802.3ad (Hangbin Liu) [RHEL-132923]
  - vsock/vmci: Clear the vmci transport packet properly when initializing it (CKI Backport Bot) [RHEL-137697] {CVE-2025-38403}
  - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (CKI Backport Bot) [RHEL-136909] {CVE-2025-40269}
  - nvme: tcp: Fix compilation warning with W=1 (John Meneghini) [RHEL-129928]
  - nvme-tcp: Fix I/O queue cpu spreading for multiple controllers (John Meneghini) [RHEL-129928]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.31.1.el9_7]
changelog:
  - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (CKI Backport Bot) [RHEL-144332] {CVE-2026-22998}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.32.1.el9_7]
changelog:
  - svcrdma: use rc_pageoff for memcpy byte offset (CKI Backport Bot) [RHEL-142790] {CVE-2025-68811}
  - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CKI Backport Bot) [RHEL-140260] {CVE-2025-68349}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.33.1.el9_7]
changelog:
  - i40e: avoid redundant VF link state updates (CKI Backport Bot) [RHEL-141877]
  - x86/sev: Guard sev_evict_cache() with CONFIG_AMD_MEM_ENCRYPT (Paolo Bonzini) [RHEL-128030]
  - x86/sev: Evict cache lines during SNP memory validation (Paolo Bonzini) [RHEL-128030]
  - ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans (Myron Stowe) [RHEL-132891] {CVE-2023-53034}
  - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (CKI Backport Bot) [RHEL-137683] {CVE-2025-40304}
  - crypto: iaa - Optimize rebalance_wq_table() (Jay Shin) [RHEL-137272]
  - fbdev: bitblit: bound-check glyph index in bit_putcs* (CKI Backport Bot) [RHEL-136942] {CVE-2025-40322}
  - bpf: Do not audit capability check in do_jit() (Jay Shin) [RHEL-135137]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.34.1.el9_7]
changelog:
  - scsi: storvsc: Process unsupported MODE_SENSE_10 (Li Tian) [RHEL-145183]
  - smb: client: Add tracepoint for krb5 auth (Paulo Alcantara) [RHEL-127498]
  - smb: client: improve error message when creating SMB session (Paulo Alcantara) [RHEL-127498]
  - smb: client: relax session and tcon reconnect attempts (Paulo Alcantara) [RHEL-127498]
  - cifs: #include cifsglob.h before trace.h to allow structs in tracepoints (Paulo Alcantara) [RHEL-127498]
  - smc: Fix use-after-free in __pnet_find_base_ndev(). (Mete Durlu) [RHEL-126890] {CVE-2025-40064}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.35.1.el9_7]
changelog:
  - page_pool: Fix use-after-free in page_pool_recycle_in_ring (Paolo Abeni) [RHEL-137841] {CVE-2025-38129}
  - exfat: fix double free in delayed_free (CKI Backport Bot) [RHEL-146403] {CVE-2025-38206}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.36.1.el9_7]
changelog:
  - net/smc: Remove validation of reserved bits in CLC Decline message (Mete Durlu) [RHEL-143718]
  - autofs: dont trigger mount if it cant succeed (Ian Kent) [RHEL-149495]
  - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147266] {CVE-2026-23097}
  - ice: PTP: fix missing timestamps on E825 hardware (CKI Backport Bot) [RHEL-148166]
  - fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Xin Long) [RHEL-144987]
  - tools: ynl: Specify --no-line-number in ynl-regen.sh. (Xin Long) [RHEL-144987]
  - gue: Fix skb memleak with inner IP protocol 0. (Xin Long) [RHEL-144987]
  - netlink: specs: fou: replace underscores with dashes in names (Xin Long) [RHEL-144987]
  - fou: fix initialization of grc (Xin Long) [RHEL-144987]
  - fou: Fix null-ptr-deref in GRO. (Xin Long) [RHEL-144987]
  - fou: remove warn in gue_gro_receive on unsupported protocol (Xin Long) [RHEL-144987]
  - fou: Remove XRFM from NET_FOU Kconfig (Xin Long) [RHEL-144987]
  - fou: remove sparse errors (Xin Long) [RHEL-144987]
  - redhat: enable FOU modules in kernel-modules-extra (Xin Long) [RHEL-144987]
  - s390/mm: Fix __ptep_rdp() inline assembly (Mete Durlu) [RHEL-143713]
  - dpll: expose fractional frequency offset in ppt (Ivan Vecera) [RHEL-146357]
  - dpll: zl3073x: Implement device mode setting support (Ivan Vecera) [RHEL-147459]
  - dpll: add dpll_device op to set working mode (Ivan Vecera) [RHEL-147459]
  - dpll: add dpll_device op to get supported modes (Ivan Vecera) [RHEL-147459]
  - i40e: add rh_phys_port_name mod option to behave like upstream (CKI Backport Bot) [RHEL-128237]
  - ice: add rh_phys_port_name mod option to behave like upstream (CKI Backport Bot) [RHEL-128237]
  - scsi: qla2xxx: Fix bsg_done() causing double free (Ewan D. Milne) [RHEL-146049]
  - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143545] {CVE-2025-71085}
  - tick/sched: Limit non-timekeeper CPUs calling jiffies update (Phil Auld) [RHEL-141462]
  - smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). (Mete Durlu) [RHEL-130017] {CVE-2025-40168}


author: Release Engineering <releng@rockylinux.org> - 5.14.0-611.36.1
changelog:
  - Replace sbat with Rocky Linux sbat (label)
  - Change bug tracker URL (label)
  - Ensure appended release in sbat is removed


author: Jonathan Maple <jmaple@ciq.com> - 5.14.0-611.36.1.1.0
changelog:
  - fdda527dfc89 - Jonathan Maple - 2024-10-23 - selftests/mm temporary fix of hmm infinite loop
  - sign kernels using SIG/Cloud certificate - Neil Hanlon (neil@rockylinux.org)


author: Chao YE <cye@redhat.com> [5.14.0-503.33.1.el9_5]
changelog:
  - scsi: st: New session only when Unit Attention for new tape (John Meneghini) [RHEL-62266]
  - scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset (John Meneghini) [RHEL-62266]
  - scsi: st: Don't modify unknown block number in MTIOCGET (John Meneghini) [RHEL-62266]
  - x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Chris von Recklinghausen) [RHEL-62210]
  - SUNRPC: Handle -ETIMEDOUT return from tlshd (Benjamin Coddington) [RHEL-79870]
  - SUNRPC: timeout and cancel TLS handshake with -ETIMEDOUT (Benjamin Coddington) [RHEL-79870]
  - tls: Fix tls_sw_sendmsg error handling (Benjamin Coddington) [RHEL-79870]
  - SUNRPC: Fix a hang in TLS sock_close if sk_write_pending (Benjamin Coddington) [RHEL-79870]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-503.34.1.el9_5]
changelog:
  - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82734] {CVE-2025-21785}
  - crypto: rng - Fix extrng EFAULT handling (Herbert Xu) [RHEL-70643]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-503.35.1.el9_5]
changelog:
  - cppc_cpufreq: Use desired perf if feedback ctrs are 0 or unchanged (Mark Langsdorf) [RHEL-78643]
  - coresight: etm4x: Add ACPI support in platform driver (Mark Salter) [RHEL-80223]
  - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-73024]
  - md: fix deadlock between mddev_suspend and flush bio (Nigel Croxon) [RHEL-76058] {CVE-2024-43855}
  - redhat/configs: replace IOMMU_DEFAULT_DMA_STRICT with IOMMU_DEFAULT_DMA_LAZY (Jerry Snitselaar) [RHEL-76412]
  - ibmvnic: Only record tx completed bytes once per handler (Mamatha Inamdar) [RHEL-71289]
  - ibmvnic: Only replenish rx pool when resources are getting low (Mamatha Inamdar) [RHEL-71289]
  - ibmvnic: Return error code on TX scrq flush fail (Mamatha Inamdar) [RHEL-71289]
  - intel_idle: fix ACPI _CST matching for newer Xeon platforms (David Arcari) [RHEL-62987]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-503.36.1.el9_5]
changelog:
  - cpufreq: intel_pstate: Support Emerald Rapids OOB mode (Steve Best) [RHEL-67636]
  - cxgb4: use port number to set mac addr (Michal Schmidt) [RHEL-79672]
  - ice: stop storing XDP verdict within ice_rx_buf (Petr Oros) [RHEL-76141]
  - ice: gather page_count()'s of each frag right before XDP prog call (Petr Oros) [RHEL-76141]
  - ice: put Rx buffers after being done with current frame (Petr Oros) [RHEL-76141]
  - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-74413]
  - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-74413]
  - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-74413] {CVE-2024-57933}
  - gve: guard XDP xmit NDO on existence of xdp queues (Joshua Washington) [RHEL-74413] {CVE-2024-57932}
  - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-74413]
  - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-74413]
  - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-74413] {CVE-2024-40937}
  - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-74413]


author: Chao YE <cye@redhat.com> [5.14.0-503.38.1.el9_5]
changelog:
  - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (CKI Backport Bot) [RHEL-86726] {CVE-2024-53150}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-503.39.1.el9_5]
changelog:
  - igb: cope with large MAX_SKB_FRAGS (Corinna Vinschen) [RHEL-75552]
  - x86/sev: Ensure that RMP table fixups are reserved (Bandan Das) [RHEL-84716]
  - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-75456] {CVE-2024-46826}
  - smb: client: fix double put of @cfile in smb2_set_path_size() (Paulo Alcantara) [RHEL-79342] {CVE-2024-46796}
  - smb: client: fix double put of @cfile in smb2_rename_path() (Paulo Alcantara) [RHEL-79342] {CVE-2024-46736}
  - smb: client: fix FSCTL_GET_REPARSE_POINT against NetApp (Paulo Alcantara) [RHEL-79342]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-503.40.1.el9_5]
changelog:
  - nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Chris Leech) [RHEL-87479] {CVE-2025-21927}
  - ipvs: properly dereference pe in ip_vs_add_service (Phil Sutter) [RHEL-75438] {CVE-2024-42322}
  - bonding: fix null pointer deref in bond_ipsec_offload_ok (CKI Backport Bot) [RHEL-75453] {CVE-2024-44990}
  - smb: client: don't retry IO on failed negprotos with soft mounts (Jay Shin) [RHEL-85523]
  - bonding: Correctly support GSO ESP offload (CKI Backport Bot) [RHEL-73403]
  - team: prevent adding a device which is already a team device lower (Hangbin Liu) [RHEL-73403]
  - team: Fix feature exposure when no ports are present (Hangbin Liu) [RHEL-73403]
  - team: Fix feature propagation of NETIF_F_GSO_ENCAP_ALL (Hangbin Liu) [RHEL-73403]
  - team: Fix initial vlan_feature set in __team_compute_features (Hangbin Liu) [RHEL-73403]
  - bonding: Fix feature propagation of NETIF_F_GSO_ENCAP_ALL (Hangbin Liu) [RHEL-73403]
  - bonding: Fix initial {vlan,mpls}_feature set in bond_compute_features (Hangbin Liu) [RHEL-73403]
  - net, team, bonding: Add netdev_base_features helper (Hangbin Liu) [RHEL-73403]
  - bonding: add ESP offload features when slaves support (Hangbin Liu) [RHEL-73403]
  - net: team: rename team to team_core for linking (Hangbin Liu) [RHEL-73403]
  - netfilter: br_netfilter: fix panic with metadata_dst skb (Ivan Vecera) [RHEL-71956]
  - bridge: mcast: Fail MDB get request on empty entry (Ivan Vecera) [RHEL-71956]
  - net: stmmac: dwmac-tegra: Fix link bring-up sequence (Jose Ignacio Tornos Martinez) [RHEL-73478]
  - kobject_uevent: Fix OOB access within zap_modalias_env() (CKI KWF BOT) [RHEL-75435] {CVE-2024-42292}


