# changelog

author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.57.1.rt7.398.el8_10]
changelog:
  - [rt] build kernel-rt-4.18.0-553.57.1.rt7.398.el8_10
  - smb: client: fix warning in cifs_smb3_do_mount() (Paulo Alcantara) [RHEL-55825]
  - cifs: fix double free race when mount fails in cifs_get_root() (Paulo Alcantara) [RHEL-55825] {CVE-2022-48919}
  - security/keys: fix slab-out-of-bounds in key_task_permission (CKI Backport Bot) [RHEL-68090] {CVE-2024-50301}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.58.1.rt7.399.el8_10]
changelog:
  - [rt] build kernel-rt-4.18.0-553.58.1.rt7.399.el8_10
  - ndisc: use RCU protection in ndisc_alloc_skb() (Xin Long) [RHEL-89535] {CVE-2025-21764}
  - ipv6: use RCU protection in ip6_default_advmss() (Xin Long) [RHEL-89535] {CVE-2025-21765}
  - net: add dev_net_rcu() helper (Xin Long) [RHEL-89535] {CVE-2025-21765}
  - net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() (Xin Long) [RHEL-89535]
  - idpf: check error for register_netdev() on init (Michal Schmidt) [RHEL-71182] {CVE-2025-22116}
  - idpf: avoid mailbox timeout delays during reset (Michal Schmidt) [RHEL-71182]
  - idpf: fix a race in txq wakeup (Michal Schmidt) [RHEL-71182]
  - idpf: fix idpf_vport_splitq_napi_poll() (Michal Schmidt) [RHEL-71182]
  - idpf: fix null-ptr-deref in idpf_features_check (Michal Schmidt) [RHEL-71182]
  - idpf: protect shutdown from reset (Michal Schmidt) [RHEL-71182]
  - idpf: fix potential memory leak on kcalloc() failure (Michal Schmidt) [RHEL-71182]
  - idpf: fix offloads support for encapsulated packets (Michal Schmidt) [RHEL-71182]
  - idpf: fix adapter NULL pointer dereference on reboot (Michal Schmidt) [RHEL-71182] {CVE-2025-22065}
  - idpf: fix checksums set in idpf_rx_rsc() (Michal Schmidt) [RHEL-71182] {CVE-2025-21890}
  - idpf: fix handling rsc packet with a single segment (Michal Schmidt) [RHEL-71182]
  - idpf: add more info during virtchnl transaction timeout/salt mismatch (Michal Schmidt) [RHEL-71182]
  - idpf: convert workqueues to unbound (Michal Schmidt) [RHEL-71182] {CVE-2024-58057}
  - idpf: Acquire the lock before accessing the xn->salt (Michal Schmidt) [RHEL-71182]
  - idpf: fix transaction timeouts on reset (Michal Schmidt) [RHEL-71182]
  - idpf: add read memory barrier when checking descriptor done bit (Michal Schmidt) [RHEL-71182]
  - idpf: deinit virtchnl transaction manager after vport and vectors (Michal Schmidt) [RHEL-71182]
  - idpf: use actual mbx receive payload length (Michal Schmidt) [RHEL-71182]
  - idpf: call set_real_num_queues in idpf_open (Michal Schmidt) [RHEL-71182 RHEL-90849]
  - idpf: fix idpf_vc_core_init error path (Michal Schmidt) [RHEL-68233 RHEL-71182 RHEL-90846] {CVE-2024-53064}
  - idpf: avoid vport access in idpf_get_link_ksettings (Michal Schmidt) [RHEL-71182 RHEL-90846] {CVE-2024-50274}
  - idpf: fix netdev Tx queue stop/wake (Michal Schmidt) [RHEL-71182]
  - idpf: fix UAFs when destroying the queues (Michal Schmidt) [RHEL-71182] {CVE-2024-44932}
  - idpf: fix memleak in vport interrupt configuration (Michal Schmidt) [RHEL-71182]
  - idpf: fix memory leaks and crashes while performing a soft reset (Michal Schmidt) [RHEL-71182] {CVE-2024-44964}
  - idpf: compile singleq code only under default-n CONFIG_IDPF_SINGLEQ (Michal Schmidt) [RHEL-71182]
  - redhat/configs: set CONFIG_IDPF_SINGLEQ as disabled (Michal Schmidt) [RHEL-71182]
  - idpf: merge singleq and splitq &net_device_ops (Michal Schmidt) [RHEL-71182]
  - idpf: avoid bloating &idpf_q_vector with big %NR_CPUS (Michal Schmidt) [RHEL-71182]
  - idpf: split &idpf_queue into 4 strictly-typed queue structures (Michal Schmidt) [RHEL-71182]
  - idpf: remove legacy Page Pool Ethtool stats (Michal Schmidt) [RHEL-71182]
  - net: remove gfp_mask from napi_alloc_skb() [idpf] (Michal Schmidt) [RHEL-71182]
  - idpf: stop using macros for accessing queue descriptors (Michal Schmidt) [RHEL-71182]
  - idpf: don't enable NAPI and interrupts prior to allocating Rx buffers (Michal Schmidt) [RHEL-71182]
  - idpf: Interpret .set_channels() input differently (Michal Schmidt) [RHEL-71182]
  - idpf: make virtchnl2.h self-contained (Michal Schmidt) [RHEL-71182]
  - s390/pci: Serialize device addition and removal (Mete Durlu) [RHEL-95783]
  - s390/pci: Allow re-add of a reserved but not yet removed device (Mete Durlu) [RHEL-95783]
  - s390/pci: Prevent self deletion in disable_slot() (Mete Durlu) [RHEL-95783]
  - s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Mete Durlu) [RHEL-95783]
  - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Mete Durlu) [RHEL-95783]
  - s390/pci: Fix missing check for zpci_create_device() error return (Mete Durlu) [RHEL-95783]
  - s390/pci: Fix potential double remove of hotplug slot (Mete Durlu) [RHEL-95783]
  - s390/pci: remove hotplug slot when releasing the device (Mete Durlu) [RHEL-95783]
  - s390/pci: introduce lock to synchronize state of zpci_dev's (Mete Durlu) [RHEL-95783]
  - s390/pci: rename lock member in struct zpci_dev (Mete Durlu) [RHEL-95783]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.59.1.rt7.400.el8_10]
changelog:
  - [rt] build kernel-rt-4.18.0-553.59.1.rt7.400.el8_10
  - SUNRPC: Fix Oops in xs_tcp_send_request() when transport is disconnected (Olga Kornievskaia) [RHEL-83291]
  - SUNRPC: Set TCP_CORK until the transmit queue is empty (Olga Kornievskaia) [RHEL-83291]
  - tcp: add tcp_sock_set_cork (Olga Kornievskaia) [RHEL-83291]
  - xfs: xfs_ail_push_all_sync() stalls when racing with updates (Brian Foster) [RHEL-88132]
  - Bluetooth: Fix use after free in hci_send_acl (CKI Backport Bot) [RHEL-90428] {CVE-2022-49111}
  - Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID (David Marlin) [RHEL-90468] {CVE-2022-49136}
  - Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER (David Marlin) [RHEL-90468] {CVE-2022-49136}
  - Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running (David Marlin) [RHEL-90468] {CVE-2022-49136}
  - Bluetooth: Cancel sync command before suspend and power off (David Marlin) [RHEL-90468] {CVE-2022-49136}
  - Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CKI Backport Bot) [RHEL-90468] {CVE-2022-49136}
  - fix backport of "filelock: Remove locks reliably when fcntl/close race is detected" (Scott Mayhew) [RHEL-89709]
  - NFSv4: Allow FREE_STATEID to clean up delegations (Benjamin Coddington) [RHEL-86932]
  - NFSv4.1: constify the stateid argument in nfs41_test_stateid() (Trond Myklebust) [RHEL-86932]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.60.1.rt7.401.el8_10]
changelog:
  - [rt] build kernel-rt-4.18.0-553.60.1.rt7.401.el8_10
  - xfs: don't allocate COW extents when unsharing a hole (Brian Foster) [RHEL-83037]
  - xfs: don't allocate into the data fork for an unshare request (Brian Foster) [RHEL-83037]
  - s390/ism: add release function for struct device (Mete Durlu) [RHEL-97192]
  - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CKI Backport Bot) [RHEL-99113] {CVE-2022-49846}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.61.1.rt7.402.el8_10]
changelog:
  - [rt] build kernel-rt-4.18.0-553.61.1.rt7.402.el8_10
  - s390: Add z17 elf platform (Christoph Schlameuss) [RHEL-100409]
  - ext4: ignore xattrs past end (CKI Backport Bot) [RHEL-100375] {CVE-2025-37738}
  - ext4: fix off-by-one error in do_split (CKI Backport Bot) [RHEL-100361] {CVE-2025-23150}
  - net: atm: fix use after free in lec_send() (CKI Backport Bot) [RHEL-93119] {CVE-2025-22004}
  - x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (CKI Backport Bot) [RHEL-98980] {CVE-2025-21991}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.62.1.rt7.403.el8_10]
changelog:
  - [rt] build kernel-rt-4.18.0-553.62.1.rt7.403.el8_10
  - s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand) [RHEL-87557]
  - mm/slab: make __free(kfree) accept error pointers (Mark Langsdorf) [RHEL-84410]
  - driver core: fix potential NULL pointer dereference in dev_uevent() (Mark Langsdorf) [RHEL-84410]
  - driver core: introduce device_set_driver() helper (Mark Langsdorf) [RHEL-84410]
  - Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Mark Langsdorf) [RHEL-84410]
  - cleanup: Add conditional guard helper (Mark Langsdorf) [RHEL-84410]
  - cleanup: Adjust scoped_guard() macros to avoid potential warning (Mark Langsdorf) [RHEL-84410]
  - cleanup: Remove address space of returned pointer (Mark Langsdorf) [RHEL-84410]
  - cleanup: Add usage and style documentation (Mark Langsdorf) [RHEL-84410]
  - file: add take_fd() cleanup helper (Mark Langsdorf) [RHEL-84410]
  - cleanup: Standardize the header guard define's name (Mark Langsdorf) [RHEL-84410]
  - cleanup: Add conditional guard support (Mark Langsdorf) [RHEL-84410]
  - cleanup: Make no_free_ptr() __must_check (Mark Langsdorf) [RHEL-84410]
  - locking: Introduce __cleanup() based infrastructure (Mark Langsdorf) [RHEL-84410]
  - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CKI Backport Bot) [RHEL-100343] {CVE-2022-49788}
  - media: uvcvideo: Announce the user our deprecation intentions (Desnes Nunes) [RHEL-98760]
  - media: uvcvideo: Allow changing noparam on the fly (Desnes Nunes) [RHEL-98760]
  - media: uvcvideo: Invert default value for nodrop module param (Desnes Nunes) [RHEL-98760]
  - media: uvcvideo: Propagate buf->error to userspace (Desnes Nunes) [RHEL-98760]
  - media: uvcvideo: Flush the control cache when we get an event (Desnes Nunes) [RHEL-98760]
  - media: uvcvideo: Annotate lock requirements for uvc_ctrl_set (Desnes Nunes) [RHEL-98760]
  - media: uvcvideo: Remove dangling pointers (Desnes Nunes) [RHEL-98760] {CVE-2024-58002}
  - media: uvcvideo: Remove redundant NULL assignment (Desnes Nunes) [RHEL-98760]
  - media: uvcvideo: Only save async fh if success (Desnes Nunes) [RHEL-98760]
  - media: uvcvideo: Refactor iterators (Desnes Nunes) [RHEL-98760]
  - media: uvcvideo: Fix double free in error path (CKI Backport Bot) [RHEL-98788] {CVE-2024-57980}
  - cifs: potential buffer overflow in handling symlinks (Paulo Alcantara) [RHEL-97074] {CVE-2022-49058}
  - Race between reading mdstat and stopping an md device (Nigel Croxon) [RHEL-95723]
  - fs/dcache: Control # of dentries in list_lru_node (Waiman Long) [RHEL-8578]
  - fs/dcache: Add sysctl parameter dentry-fs-klimit to control # of dentries in filesystem (Waiman Long) [RHEL-8578]
  - mm/list_lru: Make list_lru_add() return # if items in affected list_lru_node (Waiman Long) [RHEL-8578]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.63.1.rt7.404.el8_10]
changelog:
  - [rt] build kernel-rt-4.18.0-553.63.1.rt7.404.el8_10
  - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (Guillaume Nault) [RHEL-66324] {CVE-2024-50154}
  - net: ch9200: fix uninitialised access during mii_nway_restart (CKI Backport Bot) [RHEL-101200] {CVE-2025-38086}
  - mm/swapfile: add cond_resched() in get_swap_pages() (Nico Pache) [RHEL-80401] {CVE-2023-52932}
  - dlm: fix possible lkb_resource null dereference (Alexander Aring) [RHEL-64452]
  - fs: dlm: handle -EINVAL as log_error() (Alexander Aring) [RHEL-64452]
  - redhat/configs: enable CONFIG_RH_KABI_STABLE_ASM_OFFSETS (Čestmír Kalina) [RHEL-90099]
  - kabi: freeze stablelist and stackprotector-related constants (Čestmír Kalina) [RHEL-90099]
  - kabi: add redhat/kabi/asm-offsets (Čestmír Kalina) [RHEL-90099]
  - kabi: add RH_KABI_ASSERT_EQ_CONST{,EXPR} (Čestmír Kalina) [RHEL-90099]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.64.1.rt7.405.el8_10]
changelog:
  - [rt] build kernel-rt-4.18.0-553.64.1.rt7.405.el8_10
  - sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CKI Backport Bot) [RHEL-100387] {CVE-2025-21919}
  - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [RHEL-86256]
  - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (CKI Backport Bot) [RHEL-102133] {CVE-2022-49977}
  - wifi: iwlwifi: limit printed string from FW file (CKI Backport Bot) [RHEL-99367] {CVE-2025-21905}
  - workqueue: Disable printk_deferred_{enter,exit} in RT kernel (Waiman Long) [RHEL-80292]
  - workqueue: Make show_pwq() use run-length encoding (Waiman Long) [RHEL-80292]
  - workqueue: Introduce show_one_worker_pool and show_one_workqueue. (Waiman Long) [RHEL-80292]
  - workqueue: fix state-dump console deadlock (Waiman Long) [RHEL-80292]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.65.1.rt7.406.el8_10]
changelog:
  - [rt] build kernel-rt-4.18.0-553.65.1.rt7.406.el8_10
  - x86/alternatives: avoid mapping FIX_TEXT_POKE1 page when it is not required (Rafael Aquini) [RHEL-95422]
  - ext4: avoid resizing to a partial cluster size (CKI Backport Bot) [RHEL-101423] {CVE-2022-50020}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.66.1.rt7.407.el8_10]
changelog:
  - [rt] build kernel-rt-4.18.0-553.66.1.rt7.407.el8_10
  - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Xin Long) [RHEL-105415] {CVE-2025-38001}
  - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Xin Long) [RHEL-105415] {CVE-2025-38000}
  - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CKI Backport Bot) [RHEL-105415] {CVE-2025-37890}
  - sch_hfsc: make hfsc_qlen_notify() idempotent (Xin Long) [RHEL-105415]
  - crypto: algif_hash - fix double free in hash_accept (CKI Backport Bot) [RHEL-102223] {CVE-2025-38079}
  - Revert "smb: client: fix TCP timers deadlock after rmmod" (Paulo Alcantara) [RHEL-100698] {CVE-2025-22077}
  - Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Paulo Alcantara) [RHEL-100698]
  - smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Paulo Alcantara) [RHEL-100698]
  - smb: client: fix TCP timers deadlock after rmmod (Paulo Alcantara) [RHEL-100698] {CVE-2024-54680}
  - smb: client: Fix use-after-free of network namespace. (Paulo Alcantara) [RHEL-100698] {CVE-2024-53095}
  - smb: client: fix warning in generic_ip_connect() (Paulo Alcantara) [RHEL-100698]
  - net: tipc: fix refcount warning in tipc_aead_encrypt (Xin Long) [RHEL-103079]
  - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CKI Backport Bot) [RHEL-103079] {CVE-2025-38052}
  - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CKI Backport Bot) [RHEL-99013] {CVE-2025-22020}
  - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CKI Backport Bot) [RHEL-98837] {CVE-2025-21928}


