# changelog

author: Nick Clifton <nickc@redhat.com> - 2.30-119.1
changelog:
  - Backport: Fix an illegal memory access when parsing an ELF file containing corrupt symbol version information.  (#2164700)


author: Nick Clifton <nickc@redhat.com> - 2.30-119.2
changelog:
  - Backport: Fix an illegal memory access when parsing an ELF file containing corrupt symbol version information.  (RHEL-12956)


author: Marek Polacek <polacek@redhat.com> 8.5.0-13
changelog:
  - require docbook-style-xsl instead of docbook5-style-xsl (#2073888)
  - backport Default widths with -fdec-format-defaults patch (#2074614)


author: Marek Polacek <polacek@redhat.com> 8.5.0-17
changelog:
  - fix deserialization for std::normal_distribution (#2130392,
    PR libstdc++/105502)
  - initialize std::normal_distribution::_M_saved (PR libstdc++/99536)
  - reject std::make_shared<T[]> (PR libstdc++/99006)


author: Mark Wielaard <mjw@redhat.com> - 0.182-1
changelog:
  - Upgrade to upstream 0.182
    - backends: Support for tilegx has been removed.
    - config: New /etc/profile.d files to provide default $DEBUGINFOD_URLS.
    - debuginfod: More efficient package traversal, tolerate various
      errors during scanning, grooming progress is more visible and
      interruptible, more prometheus metrics.
    - debuginfod-client: Now supports compressed (kernel) ELF images.
    - libdwfl: Add ZSTD compression support.


author: Mark Wielaard <mjw@redhat.com> - 0.186-1
changelog:
  - Upgrade to upstream 0.186
    - debuginfod-client: Default $DEBUGINFOD_URLS is computed from
      drop-in files /etc/debuginfod/*.urls rather than
      hardcoded into the /etc/profile.d/debuginfod*
      scripts.
      Add $DEBUGINFOD_MAXSIZE and $DEBUGINFOD_MAXTIME settings
      for skipping large/slow transfers.
      Add $DEBUGINFOD_RETRY for retrying aborted lookups.
    - debuginfod: Supply extra HTTP response headers, describing
      archive/file names that satisfy the requested buildid content.
      Support -d :memory: option for in-memory databases.
      Protect against loops in federated server configurations.
      Add -r option to use -I/-X regexes for grooming stale files.
      Protect against wasted CPU from duplicate concurrent requests.
      Limit the duration of groom ops roughly to rescan (-t) times.
      Add --passive mode for serving from read-only database.
      Several other performance improvements & prometheus metrics.
    - libdw: Support for the NVIDIA Cuda line map extensions.
      DW_LNE_NVIDIA_inlined_call and DW_LNE_NVIDIA_set_function_name
      are defined in dwarf.h. New functions dwarf_linecontext and
      dwarf_linefunctionname.
    - translations: Update Japanese translation.


author: Mark Wielaard <mjw@redhat.com> - 0.187-4
changelog:
  - Upgrade to elfutils 0.187
    - debuginfod: Support -C option for connection thread pooling.
    - debuginfod-client: Negative cache file are now zero sized instead
      of no-permission files.
    - addr2line: The -A, --absolute option, which shows file names
      includingthe full compilation directory is now the
      default.  To get theold behavior use the new option --relative.
    - readelf, elflint: Recognize FDO Packaging Metadata ELF notes
    - libdw, debuginfo-client: Load libcurl lazily only when files need
      to be fetched remotely. libcurl is now never loaded when
      DEBUGINFOD_URLS is unset. And whenDEBUGINFOD_URLS is set,
      libcurl is only loaded when the debuginfod_begin function is
      called.
  - Add elfutils-0.187-csh-profile.patch
  - Add elfutils-0.187-debuginfod-client-fd-leak.patch
  - Add elfutils-0.187-mhd_no_dual_stack.patch
  - Add elfutils-0.187-mhd_epoll.patch
  - Add an explicit versioned requires from elfutils-debuginfod-client
    on elfutils-libs and elfutils-libelf.
  - Remove brew testsuite workarounds


author: DJ Delorie <dj@redhat.com> - 2.28-225.7
changelog:
  - Fix temporal threshold calculations (RHEL-22865)
  - Fix string and memory function tuning on small systems (RHEL-22865)


author: Lucas Zampieri <lzampier@redhat.com> [4.18.0-477.34.1.el8_8]
changelog:
  - fbcon: set_con2fb_map needs to set con2fb_map! (Wander Lairson Costa) [RHEL-1185 RHEL-1183]
  - fbcon: Fix error paths in set_con2fb_map (Wander Lairson Costa) [RHEL-1185 RHEL-1183]


author: Lucas Zampieri <lzampier@redhat.com> [4.18.0-477.35.1.el8_8]
changelog:
  - netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c (Florian Westphal) [RHEL-8442] {CVE-2023-42753}
  - sched/fair: Block nohz tick_stop when cfs bandwidth in use (Phil Auld) [RHEL-12722]
  - sched, cgroup: Restore meaning to hierarchical_quota (Phil Auld) [RHEL-12722]
  - sched/fair: Hide unused init_cfs_bandwidth() stub (Phil Auld) [RHEL-12722]
  - redhat: fix bug/zjira sort in the changelog (Patrick Talbert)
  - blk-mq: enforce op-specific segment limits in blk_insert_cloned_request (Ming Lei) [RHEL-14723]
  - ipvs: queue delayed work to expire no destination connections if expire_nodest_conn=1 (Florian Westphal) [RHEL-12378]
  - powerpc/pseries/vas: Hold mmap_mutex after mmap lock during window close (Mamatha Inamdar) [2236703 2224883]


author: Lucas Zampieri <lzampier@redhat.com> [4.18.0-477.36.1.el8_8]
changelog:
  - cifs: sanitize paths in cifs_update_super_prepath. (Ronnie Sahlberg) [RHEL-9462 2182472]
  - cifs: Fix UAF in cifs_demultiplex_thread() (Scott Mayhew) [RHEL-15158 RHEL-15160] {CVE-2023-1192}
  - RDMA/restrack: Release MR restrack when delete (Kamal Heib) [2244423 2170076]


author: Patrick Talbert <ptalbert@redhat.com> [4.18.0-477.37.1.el8_8]
changelog:
  - net: sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg (Ricardo Robaina) [RHEL-12698 2192680] {CVE-2023-31436}
  - tcp: enforce receive buffer memory limits by allowing the tcp window to shrink (Felix Maurer) [RHEL-15095 RHEL-15023]
  - netfilter: conntrack: Fix gre tunneling over ipv6 (Florian Westphal) [RHEL-15258 RHEL-12497]
  - x86/sev: Make enc_dec_hypercall() accept a size instead of npages (Vitaly Kuznetsov) [RHEL-5763 RHEL-3656]


author: Lucas Zampieri <lzampier@redhat.com> [4.18.0-477.38.1.el8_8]
changelog:
  - KVM: x86/mmu: Fix an sign-extension bug with mmu_seq that hangs vCPUs (Peter Xu) [RHEL-15120 RHEL-7210]
  - net/sched: sch_qfq: account for stab overhead in qfq_enqueue (Davide Caratti) [2225561 2225196] {CVE-2023-3611}
  - net/sched: sch_qfq: reintroduce lmax bound check for MTU (Davide Caratti) [2225561 2225196] {CVE-2023-3611}
  - net/sched: sch_qfq: refactor parsing of netlink parameters (Davide Caratti) [2225561 2225196] {CVE-2023-3611}
  - sctp: fix a potential overflow in sctp_ifwdtsn_skip (Xin Long) [RHEL-15848 2189324]
  - sctp: check send stream number after wait_for_sndbuf (Xin Long) [RHEL-15848 2189324]
  - sctp: sctp_sock_filter(): avoid list_entry() on possibly empty list (Xin Long) [RHEL-15848 2189324]
  - sctp: fail if no bound addresses can be used for a given scope (Xin Long) [RHEL-15848 2189324]
  - sctp: sysctl: make extra pointers netns aware (Xin Long) [RHEL-15848 2189324]
  - sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop (Xin Long) [RHEL-15848 2189324]
  - sctp: delete free member from struct sctp_sched_ops (Xin Long) [RHEL-15848 2189324]
  - sctp: fix memory leak in sctp_stream_outq_migrate() (Xin Long) [RHEL-15848 2189324]
  - sctp: clear out_curr if all frag chunks of current msg are pruned (Xin Long) [RHEL-15848 2189324]
  - sctp: remove the unnecessary sinfo_stream check in sctp_prsctp_prune_unsent (Xin Long) [RHEL-15848 2189324]
  - bpf: Adjust insufficient default bpf_jit_limit (Viktor Malik) [RHEL-15846 2219567]
  - bpf: Prevent increasing bpf_jit_limit above max (Viktor Malik) [RHEL-15846 2219567]
  - net: virtio_net_hdr_to_skb: count transport header in UFO (Cindy Lu) [RHEL-16331 RHEL-6030]


author: Lucas Zampieri <lzampier@redhat.com> [4.18.0-477.39.1.el8_8]
changelog:
  - Fix changelog for missing jira issues (Lucas Zampieri)
  - scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress (Chris Leech) [RHEL-12081 RHEL-8200]
  - scsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress (Chris Leech) [RHEL-12081 RHEL-8200]
  - scsi: lpfc: Early return after marking final NLP_DROPPED flag in dev_loss_tmo (Paul Ely) [RHEL-9714 RHEL-2602]
  - scsi: lpfc: Prevent use-after-free during rmmod with mapped NVMe rports (Paul Ely) [RHEL-9714 RHEL-2602]
  - scsi: lpfc: Remove reftag check in DIF paths (Paul Ely) [RHEL-11188 2229152]
  - scsi: lpfc: Revise ndlp kref handling for dev_loss_tmo_callbk and lpfc_drop_node (Paul Ely) [RHEL-11188 2229152]
  - futex: Do not apply time namespace adjustment on FUTEX_LOCK_PI (Joel Savitz) [2235393 2170113]
  - Revert 337f13046ff0 ("futex: Allow FUTEX_CLOCK_REALTIME with FUTEX_WAIT op") (Joel Savitz) [2235393 2170113]
  - kernel, fs: Introduce and use set_restart_fn() and arch_set_restart_data() (Joel Savitz) [2235393 2170113]
  - futex: Remove unneeded gotos (Joel Savitz) [2235393 2170113]
  - rtmutex: Ensure that the top waiter is always woken up (Joel Savitz) [2235393 2170113]
  - rtmutex: Add acquire semantics for rtmutex lock acquisition slow path (Joel Savitz) [2235393 2170113]
  - locking/lockdep: Fix lockdep_init_map_*() confusion (Joel Savitz) [2235393 2170113]
  - locking/lockdep: Avoid potential access of invalid memory in lock_class (Joel Savitz) [2235393 2170113]
  - lockdep: Correct lock_classes index mapping (Joel Savitz) [2235393 2170113]
  - locking/rtmutex: Squash self-deadlock check for ww_rt_mutex. (Joel Savitz) [2235393 2170113]
  - locking/rtmutex: Fix incorrect condition in rtmutex_spin_on_owner() (Joel Savitz) [2235393 2170113]
  - kallsyms: remove arch specific text and data check (Joel Savitz) [2235393 2170113]
  - lockdep: Let lock_is_held_type() detect recursive read as read (Joel Savitz) [2235393 2170113]
  - lockdep: Fix wait-type for empty stack (Joel Savitz) [2235393 2170113]
  - locking/lockdep: Improve noinstr vs errors (Joel Savitz) [2235393 2170113]
  - locking/lockdep: Correct calling tracepoints (Joel Savitz) [2235393 2170113]
  - locking/percpu-rwsem: Use this_cpu_{inc,dec}() for read_count (Joel Savitz) [2235393 2170113]
  - locking/ww_mutex: Fix runtime warning in the WW mutex selftest (Joel Savitz) [2235393 2170113]
  - nvmet-tcp: Fix a possible UAF in queue intialization setup (John Meneghini) [RHEL-11504 RHEL-11509] {CVE-2023-5178}
  - net: openvswitch: add support for l4 symmetric hashing (Antoine Tenart) [RHEL-12745 RHEL-10498]
  - block: check_events: don't bother with events if unsupported (Ming Lei) [RHEL-15057 RHEL-2407]
  - Revert "block: unexport DISK_EVENT_MEDIA_CHANGE for legacy/fringe drivers" (Ming Lei) [RHEL-15057 RHEL-2407]
  - Revert "ide: unexport DISK_EVENT_MEDIA_CHANGE for ide-gd and ide-cd" (Ming Lei) [RHEL-15057 RHEL-2407]
  - block: disk_events: introduce event flags (Ming Lei) [RHEL-15057 RHEL-2407]
  - block: genhd: remove async_events field (Ming Lei) [RHEL-15057 RHEL-2407]
  - redhat: fix to be able to build with rpm 4.19.0 (Denys Vlasenko)
  - net: tun: fix bugs for oversize packet when napi frags enabled (Ricardo Robaina) [RHEL-9228 RHEL-7185] {CVE-2023-3812}
  - ice: reset first in crash dump kernels (Petr Oros) [RHEL-15807 2139761]


author: Lucas Zampieri <lzampier@redhat.com> [4.18.0-477.40.1.el8_8]
changelog:
  - writeback: avoid use-after-free after removing device (Nico Pache) [RHEL-15453 RHEL-15447]
  - net/sched: sch_hfsc: upgrade 'rt' to 'sc' when it becomes a inner curve (Davide Caratti) [RHEL-16464 RHEL-14032] {CVE-2023-4623}
  - net/sched: sch_hfsc: Ensure inner classes have fsc curve (Davide Caratti) [RHEL-16464 RHEL-14032] {CVE-2023-4623}
  - scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress (Chris Leech) [RHEL-12081 RHEL-8200]
  - scsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress (Chris Leech) [RHEL-12081 RHEL-8200]
  - Fix double fget() in vhost_net_set_backend() (Jon Maloy) [RHEL-13210 RHEL-7162] {CVE-2023-1838}
  - vc_screen: don't clobber return value in vcs_read (Ricardo Robaina) [RHEL-15396 2221467] {CVE-2023-3567}
  - vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF (Ricardo Robaina) [RHEL-15396 2221467] {CVE-2023-3567}


author: Lucas Zampieri <lzampier@redhat.com> [4.18.0-477.41.1.el8_8]
changelog:
  - perf/core: Fix potential NULL deref (Wander Lairson Costa) [RHEL-18003 RHEL-14982] {CVE-2023-5717}
  - perf: Disallow mis-matched inherited group reads (Wander Lairson Costa) [RHEL-18003 RHEL-14982] {CVE-2023-5717}
  - x86/sev: Check for user-space IOIO pointing to kernel space (Wander Lairson Costa) [RHEL-18012 RHEL-14978] {CVE-2023-46813}
  - x86/sev: Check IOBM for IOIO exceptions from user-space (Wander Lairson Costa) [RHEL-18012 RHEL-14978] {CVE-2023-46813}
  - x86/sev: Disable MMIO emulation from user mode (Wander Lairson Costa) [RHEL-18012 RHEL-14978] {CVE-2023-46813}
  - x86/sev-es: Fix SEV-ES OUT/IN immediate opcode vc handling (Wander Lairson Costa) [RHEL-18012 RHEL-14978] {CVE-2023-46813}
  - net: mpls: fix stale pointer if allocation fails during device rename (Guillaume Nault) [RHEL-18833 2184956] {CVE-2023-26545}
  - net: fix net device address assign type (Michal Schmidt) [RHEL-17295 RHEL-6383]
  - net: add check for current MAC address in dev_set_mac_address (Michal Schmidt) [RHEL-17295 RHEL-6383]
  - HID: asus: use spinlock to safely schedule workers (Ricardo Robaina) [RHEL-18836 2186282] {CVE-2023-1079}
  - HID: asus: use spinlock to protect concurrent accesses (Ricardo Robaina) [RHEL-18836 2186282] {CVE-2023-1079}
  - gitlab-ci: remove RT check pipelines (Michael Hofmann)
  - net/tls: Remove the context from the list in tls_device_down (Jay Shin) [RHEL-17818 RHEL-17301]
  - tls: Fix context leak on tls_device_down (Jay Shin) [RHEL-17818 RHEL-17301]
  - scsi: zfcp: Defer fc_rport blocking until after ADISC response (Tobias Huschle) [RHEL-15847 2230241]
  - s390/dasd: print copy pair message only for the correct error (Tobias Huschle) [RHEL-9443 RHEL-2831]
  - pNFS/filelayout: treat GETDEVICEINFO errors as layout failure (Scott Mayhew) [RHEL-16406 RHEL-4969]
  - af_unix: Fix null-ptr-deref in unix_stream_sendpage(). (Guillaume Nault) [RHEL-16158 RHEL-2574] {CVE-2023-4622}


author: Lucas Zampieri <lzampier@redhat.com> [4.18.0-477.42.1.el8_8]
changelog:
  - media: saa7134: fix use after free bug in saa7134_finidev due to race condition (Wander Lairson Costa) [RHEL-18866 2215902] {CVE-2023-35823}
  - media: dm1105: Fix use after free bug in dm1105_remove due to race condition (Dean Nelson) [RHEL-18868 2215904] {CVE-2023-35824}
  - sched/rt: Fix bad task migration for rt tasks (Valentin Schneider) [RHEL-11681 RHEL-3872]
  - HID: check empty report_list in hid_validate_values() (Desnes Nunes) [RHEL-18847 RHEL-19237] {CVE-2023-1073}
  - HID: betop: check shape of output reports (Desnes Nunes) [RHEL-18847 2212164] {CVE-2023-1073}
  - net: qcom/emac: Fix use after free bug in emac_remove due to race condition (Ricardo Robaina) [RHEL-18843 2192673] {CVE-2023-33203}
  - prlimit: do_prlimit needs to have a speculation check (Alex Gladkov) [RHEL-18845 2196314] {CVE-2023-0458}
  - media: usb: siano: Fix warning due to null work_func_t function pointer (Desnes Nunes) [RHEL-18878 2216483] {CVE-2023-4132}
  - media: usb: siano: Fix use after free bugs caused by do_submit_urb (Desnes Nunes) [RHEL-18878 2216483] {CVE-2023-4132}
  - bpf: Fix incorrect verifier pruning due to missing register precision taints (Artem Savkov) [RHEL-8973 RHEL-7534] {CVE-2023-2163}


author: Lucas Zampieri <lzampier@redhat.com> [4.18.0-477.43.1.el8_8]
changelog:
  - xfrm: add NULL check in xfrm_update_ae_params (Daniel Mendes) [RHEL-18876 2218948] {CVE-2023-3772}
  - memstick: r592: Fix UAF bug in r592_remove due to race condition (Wander Lairson Costa) [RHEL-18869 2215906] {CVE-2023-35825}
  - net: sched: atm: dont intepret cls results when asked to drop (Davide Caratti) [RHEL-18818 2168336] {CVE-2023-23455}
  - hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition (Chris von Recklinghausen) [RHEL-18831 2184583] {CVE-2023-1855}
  - net/tls: tls_is_tx_ready() checked list_entry (Sabrina Dubroca) [RHEL-18848]
  - media: dvb-usb: az6027: fix three null-ptr-deref in az6027_i2c_xfer() (Desnes Nunes) [RHEL-18827 2177389] {CVE-2023-28328}
  - media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer() (Desnes Nunes) [RHEL-18827 2177389] {CVE-2023-28328}
  - md/raid5: release batch_last before waiting for another stripe_head (Nigel Croxon) [RHEL-12283 RHEL-9875]
  - igb: set max size RX buffer when store bad packet is enabled (Wander Lairson Costa) [RHEL-15186 RHEL-15188] {CVE-2023-45871}
  - memstick: r592: Fix UAF bug in r592_remove due to race condition (Ricardo Robaina) [RHEL-18854 2213205] {CVE-2023-3141}


author: Lucas Zampieri <lzampier@redhat.com> [4.18.0-477.49.1.el8_8]
changelog:
  - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (Rafael Aquini) [RHEL-24454 RHEL-22476]
  - ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet (Hangbin Liu) [RHEL-21643] {CVE-2023-6932}
  - drm/vmwgfx: Keep a gem reference to user bos in surfaces (Jocelyn Falempe) [RHEL-18941 RHEL-14510] {CVE-2023-5633}
  - drm/vmwgfx: Fix possible invalid drm gem put calls (Jocelyn Falempe) [RHEL-18941 RHEL-14510] {CVE-2023-5633}
  - drm/vmwgfx: Remove rcu locks from user resources (Jocelyn Falempe) [RHEL-18801 RHEL-18803 2133493 2133499] {CVE-2022-38457 CVE-2022-40133}
  - drm/vmwgfx: Remove vmwgfx_hashtab (Jocelyn Falempe) [RHEL-18801 RHEL-18803 2133493 2133499] {CVE-2022-38457 CVE-2022-40133}
  - drm/vmwgfx: Refactor ttm reference object hashtable to use linux/hashtable. (Jocelyn Falempe) [RHEL-18801 RHEL-18803 2133493 2133499] {CVE-2022-38457 CVE-2022-40133}
  - drm/vmwgfx: Refactor resource validation hashtable to use linux/hashtable implementation. (Jocelyn Falempe) [RHEL-18801 RHEL-18803 2133493 2133499] {CVE-2022-38457 CVE-2022-40133}
  - drm/vmwgfx: Remove ttm object hashtable (Jocelyn Falempe) [RHEL-18801 RHEL-18803 2133493 2133499] {CVE-2022-38457 CVE-2022-40133}
  - drm/vmwgfx: Refactor resource manager's hashtable to use linux/hashtable implementation. (Jocelyn Falempe) [RHEL-18801 RHEL-18803 2133493 2133499] {CVE-2022-38457 CVE-2022-40133}
  - drm/vmwgfx: clean up some error pointer checking (Jocelyn Falempe) [RHEL-18801 RHEL-18803 2133493 2133499] {CVE-2022-38457 CVE-2022-40133}
  - drm/vmwgfx: Fix shader stage validation (Jocelyn Falempe) [RHEL-20804 RHEL-3178] {CVE-2022-36402}
  - drm/vmwgfx: Do not drop the reference to the handle too soon (Jocelyn Falempe) [RHEL-18871 RHEL-18874 2218197 2218214] {CVE-2023-33952 CVE-2023-33951}
  - drm/vmwgfx: Stop accessing buffer objects which failed init (Jocelyn Falempe) [RHEL-18871 RHEL-18874 2218197 2218214] {CVE-2023-33952 CVE-2023-33951}
  - drm/atomic: Fix potential use-after-free in nonblocking commits (Jocelyn Falempe) [RHEL-23476 RHEL-22511] {CVE-2023-51043}
  - netfilter: nf_tables: reject QUEUE/DROP verdict parameters (Florian Westphal) [RHEL-24009 2262126] {CVE-2024-1086}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [4.18.0-477.50.1.el8_8.g6d68]
changelog:
  - IB/IPoIB: Fix queue count inconsistency for PKEY child interfaces (Kamal Heib) [RHEL-19835 2170076]
  - IB/IPoIB: Fix legacy IPoIB due to wrong number of queues (Kamal Heib) [RHEL-19835 2170076]
  - drm/vmwgfx: Fix possible null pointer derefence with invalid contexts (Jocelyn Falempe) [RHEL-22765 RHEL-3179] {CVE-2022-38096}
  - s390/dasd: Use correct lock while counting channel queue length (Tobias Huschle) [RHEL-22643 2215889]
  - smb: client: fix OOB in receive_encrypted_standard() (Scott Mayhew) [RHEL-22076 RHEL-21685] {CVE-2024-0565}
  - powerpc: Don't select HAVE_IRQ_EXIT_ON_IRQ_STACK (Mamatha Inamdar) [RHEL-1122 2218348]
  - rbd: don't move requests to the running list on errors (Ilya Dryomov) [RHEL-24203 RHEL-21941]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [4.18.0-477.51.1.el8_8]
changelog:
  - KVM: x86: Constrain guest-supported xfeatures only at KVM_GET_XSAVE{2} (Bandan Das) [RHEL-23062 RHEL-7558]
  - x86/fpu: Allow caller to constrain xfeatures when copying to uabi buffer (Bandan Das) [RHEL-23062 RHEL-7558]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [4.18.0-477.52.1.el8_8]
changelog:
  - Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp} (Ricardo Robaina) [RHEL-18806 2139617] {CVE-2022-3640}
  - Bluetooth: L2CAP: Fix build errors in some archs (Ricardo Robaina) [RHEL-18806 2139617] {CVE-2022-3640}
  - Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm regression (Ricardo Robaina) [RHEL-18806 2139617] {CVE-2022-3640}
  - Bluetooth: L2CAP: fix use-after-free in l2cap_conn_del() (Ricardo Robaina) [RHEL-18806 2139617] {CVE-2022-3640}
  - Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put (Ricardo Robaina) [RHEL-18806 2139617] {CVE-2022-3640}
  - ibmveth: Remove condition to recompute TCP header checksum. (Mamatha Inamdar) [RHEL-20821 RHEL-12553]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [4.18.0-477.53.1.el8_8]
changelog:
  - ceph: don't let check_caps skip sending responses for revoke msgs (Xiubo Li) [RHEL-20908 RHEL-16412]
  - ceph: issue a cap release immediately if no cap exists (Xiubo Li) [RHEL-20908 RHEL-16412]
  - ceph: trigger to flush the buffer when making snapshot (Xiubo Li) [RHEL-20908 RHEL-16412]
  - ceph: force updating the msg pointer in non-split case (Xiubo Li) [RHEL-20908 RHEL-16412]
  - ceph: flush cap releases when the session is flushed (Xiubo Li) [RHEL-20908 RHEL-16412]
  - ceph: reorder fields in 'struct ceph_snapid_map' (Xiubo Li) [RHEL-20908 RHEL-16412]
  - ceph: voluntarily drop Xx caps for requests those touch parent mtime (Xiubo Li) [RHEL-20908 RHEL-16412]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [4.18.0-477.54.1.el8_8]
changelog:
  - ext4: fix kernel BUG in 'ext4_write_inline_data_end()' (Carlos Maiolino) [RHEL-26330 RHEL-23386] {CVE-2021-33631}
  - smsc95xx: fix stalled rx after link change (Izabela Bakollari) [RHEL-25718 RHEL-22312]
  - dm-crypt, dm-verity: disable tasklets (Benjamin Marzinski) [RHEL-26100 RHEL-22232]
  - dm verity: initialize fec io before freeing it (Benjamin Marzinski) [RHEL-26100 RHEL-22232]
  - dm-verity: don't use blocking calls from tasklets (Benjamin Marzinski) [RHEL-26100 RHEL-22232]
  - dm crypt: avoid accessing uninitialized tasklet (Benjamin Marzinski) [RHEL-26100 2192702]
  - s390/qeth: Fix vipa deletion (Tobias Huschle) [RHEL-25810 RHEL-11194]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [4.18.0-477.55.1.el8_8]
changelog:
  - Bluetooth: L2CAP: Fix attempting to access uninitialized memory (David Marlin) [RHEL-18808 2148408] {CVE-2022-42895}
  - serial: core: return early on unsupported ioctls (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - lib/hexdump: make print_hex_dump_bytes() a nop on !DEBUG builds (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix race condition in status line change on dead connections (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - Revert "tty: n_gsm: fix UAF in gsm_cleanup_mux" (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix UAF in gsm_cleanup_mux (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: add parameter negotiation support (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: add parameters used with parameter negotiation (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: introduce macro for minimal unit size (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: name the debug bits (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: introduce gsm_control_command() function (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: replace use of gsm_read_ea() with gsm_read_ea_val() (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: name gsm tty device minors (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: initialize more members at gsm_alloc_mux() (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: add sanity check for gsm->receive in gsm_receive_buf() (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix flow control handling in tx path (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix resource allocation order in gsm_activate_mux() (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix deadlock and link starvation in outgoing data path (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix race condition in gsmld_write() (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix non flow control frames during mux flow off (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix missing timer to handle stalled links (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix wrong queuing behavior in gsm_dlci_data_output() (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix tty registration before control channel open (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix user open not possible at responder until initiator open (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: Debug output allocation must use GFP_ATOMIC (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: Fix packet data hex dump output (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix buffer over-read in gsm_dlci_data() (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix sometimes uninitialized warning in gsm_dlci_modem_output() (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix software flow control handling (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix invalid use of MSC in advanced option (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix broken virtual tty handling (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix missing update of modem controls after DLCI open (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix reset fifo race condition (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix missing tty wakeup in convergence layer type 2 (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix wrong signal octets encoding in MSC (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix wrong command frame length field encoding (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix wrong command retry handling (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix missing explicit ldisc flush (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix wrong DLCI release order (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix insufficient txframe size (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix frame reception handling (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix wrong signal octet encoding in convergence layer type 2 (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix mux cleanup after unregister tty device (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix decoupled mux resource (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix restart handling via CLD command (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix deadlock in gsmtty_open() (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix wrong modem processing in convergence layer type 2 (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix wrong tty control line for flow control (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix NULL pointer access due to DLCI release (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix encoding of command/response bit (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix SW flow control encoding/handling (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - mxser: remove tty parameter from mxser_receive_chars_new() (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - mxser: don't throttle manually (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - mxser: make mxser_port::ldisc_stop_rx a bool (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: Don't ignore write return value in gsmld_output() (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: clean up indenting in gsm_queue() (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: Save dlci address open status when config requester (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: Modify gsmtty driver register method when config requester (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: Delete gsmtty open SABM frame when config requester (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: Modify CR,PF bit printk info when config requester (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: Modify CR,PF bit when config requester (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: stop using alloc_tty_driver (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: don't store semi-state into tty drivers (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - hvsi: don't panic on tty_register_driver failure (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - amiserial: switch rs_table to a single state (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - amiserial: expand "custom" (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - amiserial: use memset to zero serial_state (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - amiserial: remove serial_* strings (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - mxser: drop mxser_port::custom_divisor (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - mxser: drop mxser_port::baud_base (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - mxser: remove unused mxser_port::stop_rx (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - mxser: don't allocate MXSER_PORTS + 1 (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - mxser: remove cnt from mxser_receive_chars (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - mxser: remove MOXA_GETMSTATUS ioctl (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - mxser: remove MOXA_GETDATACOUNT ioctl (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - mxser: remove MOXA_CHKPORTENABLE ioctl (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - mxser: remove MOXA_ASPP_LSTATUS ioctl (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - mxser: remove MOXA_ASPP_MON and friends (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - mxser: remove MOXA_SET_BAUD_METHOD ioctl (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - mxser: remove MOXA_GET_MAJOR deprecated ioctl (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - mxser: drop unused MOXA_DIAGNOSE macro (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - mxser: drop UART_MCR_AFE and UART_LSR_SPECIAL defines (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - mxser: remove else from LSR bits checks (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - mxser: extract mxser_receive_chars_old (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - mxser: extract mxser_receive_chars_new (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - mxser: simplify mxser_interrupt and drop mxser_board::vector_mask (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - mxser: extract port ISR (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - mxser: cleanup LSR handling in mxser_receive_chars (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - mxser: remove nonsense from ISR (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - mxser: drop constant board::uart_type (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - mxser: introduce enum mxser_must_hwid (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - mxser: rename mxser_board::chip_flag to must_hwid (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - mxser: rename CheckIsMoxaMust to mxser_get_must_hwid (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - mxser: cleanup Gpci_uart_info struct (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - mxser: integrate mxser.h into .c (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - mxser: drop ISA support (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - n_gsm: use goto-failpaths in gsm_init (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: mxser: drop low-latency workaround (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: check error while registering tty devices (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: mxser: fix TIOCSSERIAL jiffies conversions (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm, remove duplicates of parameters (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: do not check tty_unregister_driver's return value (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: nozomi, remove init/exit messages (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty_port: drop last traces of low_latency (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: Demote obvious abuse of kernel-doc and supply other missing docss (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm, eliminate indirection for gsm->{output,error}() (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: Fix bogus i++ in gsm_data_kick (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: Remove unnecessary test in gsm_print_packet() (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: Fix waking up upper tty layer when room available (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: Fix SOF skipping (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: Improve debug output (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - n_gsm: switch constipated to bool (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - n_gsm: switch throttled to bool (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - n_gsm: switch dead to bool (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - n_gsm: introduce enum gsm_dlci_mode (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - n_gsm: introduce enum gsm_dlci_state (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - n_gsm: drop unneeded gsm_dlci->fifo field (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: Replace zero-length array with flexible-array member (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: avoid recursive locking with async port hangup (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: add helpers to convert mux-num to/from tty-base (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - docs: serial: move it to the driver-api (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - docs: serial: convert docs to ReST and rename to *.rst (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: Mark expected switch fall-throughs (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - n_gsm: Constify u8 and unsigned char usage (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: Add copy_config() and gsm_config() to prepare for serdev (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - mxser: switch to ->[sg]et_serial() (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - amiserial: switch to ->[sg]et_serial() (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}
  - tty/serial_core: add ISO7816 infrastructure (Wander Lairson Costa) [RHEL-19953 RHEL-19955] {CVE-2023-6546}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [4.18.0-477.56.1.el8_8]
changelog:
  - cgroup/rstat: Optimize cgroup_rstat_updated_list() (Waiman Long) [RHEL-30192 RHEL-18154]
  - cgroup/rstat: Reduce cpu_lock hold time in cgroup_rstat_flush_locked() (Waiman Long) [RHEL-30192 RHEL-18154]
  - cgroup/rstat: check updated_next only for root (Waiman Long) [RHEL-30192 2193485]
  - cgroup: rstat: explicitly put loop variant in while (Waiman Long) [RHEL-30192 2193485]
  - cgroup: use irqsave in cgroup_rstat_flush_locked(). (Waiman Long) [RHEL-30192 RHEL-18154]
  - cgroup: fix spelling mistakes (Waiman Long) [RHEL-30192 RHEL-18154]
  - x86/coco: Disable 32-bit emulation by default on TDX and SEV (Vitaly Kuznetsov) [RHEL-30263 RHEL-30265] {CVE-2024-25744}
  - x86: Make IA32_EMULATION boot time configurable (Vitaly Kuznetsov) [RHEL-30263 RHEL-30265] {CVE-2024-25744}
  - x86/entry: Make IA32 syscalls' availability depend on ia32_enabled() (Vitaly Kuznetsov) [RHEL-30263 RHEL-30265] {CVE-2024-25744}
  - x86/elf: Make loading of 32bit processes depend on ia32_enabled() (Vitaly Kuznetsov) [RHEL-30263 RHEL-30265] {CVE-2024-25744}
  - x86/entry: Rename ignore_sysret() (Vitaly Kuznetsov) [RHEL-30263 RHEL-30265] {CVE-2024-25744}
  - x86/cpu: Don't write CSTAR MSR on Intel CPUs (Vitaly Kuznetsov) [RHEL-30263 RHEL-30265] {CVE-2024-25744}
  - x86: Introduce ia32_enabled() (Vitaly Kuznetsov) [RHEL-30263 RHEL-30265] {CVE-2024-25744}


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [4.18.0-477.57.1.el8_8]
changelog:
  - nvmet-tcp: Fix the H2C expected PDU len calculation (Maurizio Lombardi) [RHEL-22298 RHEL-22635 RHEL-22640 RHEL-19167] {CVE-2023-6535 CVE-2023-6356 CVE-2023-6536}
  - nvmet-tcp: remove boilerplate code (Maurizio Lombardi) [RHEL-22298 RHEL-22635 RHEL-22640 RHEL-19167] {CVE-2023-6535 CVE-2023-6356 CVE-2023-6536}
  - nvmet-tcp: add bounds check on Transfer Tag (Maurizio Lombardi) [RHEL-22298 RHEL-22635 RHEL-22640 RHEL-19167] {CVE-2023-6535 CVE-2023-6356 CVE-2023-6536}
  - nvmet-tcp: fix a crash in nvmet_req_complete() (Maurizio Lombardi) [RHEL-22298 RHEL-22635 RHEL-22640 RHEL-19167] {CVE-2023-6535 CVE-2023-6356 CVE-2023-6536}
  - nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length (Maurizio Lombardi) [RHEL-22298 RHEL-22635 RHEL-22640 RHEL-19167] {CVE-2023-6535 CVE-2023-6356 CVE-2023-6536}
  - Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d" (Nigel Croxon) [RHEL-27235 RHEL-22698]
  - netfilter: nf_tables: disallow anonymous set with timeout flag (Phil Sutter) [RHEL-32977 RHEL-30080] {CVE-2024-26642}
  - media: rc: Fix use-after-free bugs caused by ene_tx_irqsim() (Ricardo Robaina) [RHEL-18820 2174409] {CVE-2023-1118}
  - SUNRPC: Fix UAF in svc_tcp_listen_data_ready() (Jay Shin) [RHEL-32174 2218539]


author: Patrick Talbert <ptalbert@redhat.com> [4.18.0-477.58.1.el8_8]
changelog:
  - sched/membarrier: reduce the ability to hammer on sys_membarrier (Wander Lairson Costa) [RHEL-26388 RHEL-23430] {CVE-2024-26602}
  - x86/sev: Harden #VC instruction emulation somewhat (Vitaly Kuznetsov) [RHEL-30037 RHEL-30040] {CVE-2024-25742 CVE-2024-25743}
  - crypto: rsa - add a check for allocation failure (Vladis Dronov) [RHEL-36693 RHEL-35361]
  - crypto: rsa - allow only odd e and restrict value in FIPS mode (Vladis Dronov) [RHEL-36693 RHEL-35361]
  - KEYS: use kfree_sensitive with key (Vladis Dronov) [RHEL-36693 RHEL-35361]
  - lib/mpi: Extend the MPI library (only mpi_*_bit() part) (Vladis Dronov) [RHEL-36693 RHEL-35361]
  - x86/apic/x2apic: Fix a NULL pointer deref when handling a dying cpu (David Arcari) [RHEL-32733 RHEL-32516]
  - ceph: pass ino# instead of old_dentry if it's disconnected (Xiubo Li) [RHEL-35284 RHEL-32870]
  - x86/elf: Fix regression with process core dumps (Vitaly Kuznetsov) [RHEL-33448]
  - net: bridge: use DEV_STATS_INC() (Ivan Vecera) [RHEL-31414 RHEL-27989] {CVE-2023-52578}
  - net: Fix unwanted sign extension in netdev_stats_to_stats64() (Ivan Vecera) [RHEL-31414 RHEL-27989] {CVE-2023-52578}
  - net: add atomic_long_t to net_device_stats fields (Ivan Vecera) [RHEL-31414 RHEL-27989] {CVE-2023-52578}
  - xfs: run blockgc on freeze to avoid inode inactivation deadlock (Brian Foster) [RHEL-34523 RHEL-11344]
  - net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send (Ken Cox) [RHEL-34063 RHEL-27316] {CVE-2021-47013}
  - mlxsw: spectrum_acl_tcam: Fix stack corruption (Ivan Vecera) [RHEL-29183 RHEL-26462] {CVE-2024-26586}
  - x86/speculation: Allow enabling STIBP with legacy IBRS (Ricardo Robaina) [RHEL-18839 2187268] {CVE-2023-1998}


author: David Howells <dhowells@redhat.com> - 1.5.10-1
changelog:
  - Include sys/types.h in keyutils.h.
  - The dns resolver needs limits.h.
  - Overhaul of all manual pages.
  - Some manual pages moved to Linux man-pages project.
  - Add Diffie-Helman keyctl function.


author: Julien Rische <jrische@redhat.com> - 1.18.2-21
changelog:
  - Backport fix of memory use after free during libkrad cleanup
  - Backport support for larger RADIUS attributes in libkrad
  - Resolves: rhbz#2103125


author: Lukas Czerner <lczerner@redhat.com> 1.45.4-1
changelog:
  - Rebase to the release 1.45.4 (#1783777)
  - provide rhel6/7 compatible fs_type in mke2fs.conf (#1780279)
  - fix crafted ext4 partition leads to out-of-bounds write (#1768709)
  - include note about supported rhel8 features and options (#1788573)


author: Lukas Czerner <lczerner@redhat.com> 1.45.6-5
changelog:
  - Update e2fsprogs with upstream fixes and improvements (#2083621)
  - Fix out-of-bounds read/write via crafter filesystem (#2073548)


author: Petr Lautrbach <plautrba@redhat.com> - 2.9-2.1
changelog:
  - Use Python distutils to install SELinux python bindings (#1719771)
  - Move  sefcontext_compile to -utils package (#1612518)


author: Vit Mojzis <vmojzis@redhat.com> - 2.9-6
changelog:
  - Describe fcontext regular expressions (#1904059)
  - Strip spaces before values in config (#2012145)


author: Petr Lautrbach <plautrba@redhat.com> - 2.7-5
changelog:
  - cil: Create new keep field for type attribute sets
  - build: follow standard semantics for DESTDIR and PREFIX
  - cil: show an error when cil_expr_to_string() fails


author: Petr Lautrbach <plautrba@redhat.com> - 2.7-6
changelog:
  - Prevent freeing unitialized value in ibendport handling
  - Add support for the SCTP portcon keyword
  - Export sepol_polcap_getnum/name functions


author: Vit Mojzis <vmojzis@redhat.com> - 2.9-3
changelog:
  - cil: Fix out-of-bound read of file context pattern ending with "\"
  - cil: Destroy classperms list when resetting classpermission (#1983517)
  - cil: Destroy classperm list when resetting map perms (#1983521)
  - cil: cil_reset_classperms_set() should not reset classpermission (#1983525)
  - cil: Set class field to NULL when resetting struct cil_classperms
  - cil: More strict verification of constraint leaf expressions
  - cil: Exit with an error if declaration name is a reserved word
  - cil: Allow permission expressions when using map classes
  - cil: Reorder checks for invalid rules when building AST
  - cil: Cleanup build AST helper functions
  - cil: Create new first child helper function for building AST
  - cil: Remove unused field from struct cil_args_resolve
  - cil: Destroy disabled optional blocks after pass is complete
  - cil: Check if name is a macro parameter first
  - cil: fix NULL pointer dereference in __cil_insert_name
  - cil: Report disabling an optional block only at high verbose levels
  - cil: Use AST to track blocks and optionals when resolving
  - cil: Reorder checks for invalid rules when resolving AST
  - cil: Sync checks for invalid rules in booleanifs
  - cil: Check for statements not allowed in optional blocks (#1983530)


author: Björn Esser <besser82@fedoraproject.org> - 4.0.1-5
changelog:
  - Add patch to update to recent development branch
  - Re-enable SUNMD5 support as it is BSD licensed now
  - Build compatibility symbols for glibc only
  - Skip failing testsuite once


author: Jarod Wilson <jarod@redhat.com> - 20220713-109.gitdfa29317
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Include even newer qed firmware update (rhbz 2040269)


author: Jarod Wilson <jarod@redhat.com> - 20220726-110.git150864a4
changelog:
  - Omit unused password-protected vxge firmware files from package (rhbz 2108051)
  - Pick up latest AMD GPU firmwares


author: Lucas Zampieri <lzampier@redhat.com> - 20221102-111.git8bb75626
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - amdgpu firmware update to fix certain "multiple monitor scenarios" (rhbz 2130707)


author: Lucas Zampieri <lzampier@redhat.com> - 20230111-112.gita1ad1d5b
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Navi33 dGPU firmware (rhbz 2047480)
  - Navi31 dGPU firmware (rhbz 2047483)


author: Lucas Zampieri <lzampier@redhat.com> - 20230217-113.git83f1d778
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Qualcomm Wi-Fi - Disconnecting power cable during suspend wakes up the laptop (rhbz 2169012)


author: Patrick Talbert <ptalbert@redhat.com> - 20230404-114.git2e92a49f
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Intel QAT Update - firmware for QAT (rhbz 2030316)


author: Patsy Griffin Franklin <pfrankli@redhat.com> 1:4.2.1-7
changelog:
  - Fix build failure caused by automake versioning differences related
    to the glob changes. (#1589769)
  - Fix testing failure due to Perl changes related to expanding paths.


author: Sahana Prasad <sahana@redhat.com> - 1:1.1.1k-4
changelog:
  - Fixes bugs in s390x AES code.
  - Uses the first detected address family if IPv6 is not available
  - Reverts the changes in https://github.com/openssl/openssl/pull/13305
    as it introduces a regression if server has a DSA key pair, the handshake fails
    when the protocol is not explicitly set to TLS 1.2. However, if the patch is reverted,
    it has an effect on the "ssl_reject_handshake" feature in nginx. Although, this feature
    will continue to work, TLS 1.3 protocol becomes unavailable/disabled. This is already
    known - https://trac.nginx.org/nginx/ticket/2071#comment:1
    As per https://github.com/openssl/openssl/issues/16075#issuecomment-879939938, nginx
    could early callback instead of servername callback.
  - Resolves: rhbz#1978214
  - Related: rhbz#1934534


author: Sahana Prasad <sahana@redhat.com> - 1:1.1.1k-5
changelog:
  - Fixes CVE-2021-3712 openssl: Read buffer overruns processing ASN.1 strings
  - Resolves: rhbz#2005402


author: Clemens Lang <cllang@redhat.com> - 1:1.1.1k-6
changelog:
  - Fixes CVE-2022-0778 openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  - Resolves: rhbz#2067146


author: Clemens Lang <cllang@redhat.com> - 1:1.1.1k-7
changelog:
  - Fix CVE-2022-2097: AES OCB fails to encrypt some bytes on 32-bit x86
    Resolves: CVE-2022-2097
  - Update expired certificates used in the testsuite
    Resolves: rhbz#2092462
  - Fix CVE-2022-1292: openssl: c_rehash script allows command injection
    Resolves: rhbz#2090372
  - Fix CVE-2022-2068: the c_rehash script allows command injection
    Resolves: rhbz#2098279


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:1.1.1k-9
changelog:
  - Fixed Timing Oracle in RSA Decryption
    Resolves: CVE-2022-4304
  - Fixed Double free after calling PEM_read_bio_ex
    Resolves: CVE-2022-4450
  - Fixed Use-after-free following BIO_new_NDEF
    Resolves: CVE-2023-0215
  - Fixed X.400 address type confusion in X.509 GeneralName
    Resolves: CVE-2023-0286


author: Clemens Lang <cllang@redhat.com> - 1:1.1.1k-10
changelog:
  - Fix CVE-2023-3446: Excessive time spent checking DH keys and parameters
    Resolves: RHEL-14244
  - Fix CVE-2023-3817: Excessive time spent checking DH q parameter value
    Resolves: RHEL-14238


author: Clemens Lang <cllang@redhat.com> - 1:1.1.1k-11
changelog:
  - Fix CVE-2023-5678: Generating excessively long X9.42 DH keys or checking
    excessively long X9.42 DH keys or parameters may be very slow
    Resolves: RHEL-16537


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:1.1.1k-12
changelog:
  - Backport implicit rejection mechanism for RSA PKCS#1 v1.5 to RHEL-8 series
    (a proper fix for CVE-2020-25659)
    Resolves: RHEL-17695


author: Petr Pisar <ppisar@redhat.com> - 10.31-6
changelog:
  - Fix global search/replace in pcre2test and pcre2_substitute() when the pattern
    matches an empty string, but never at the starting offset


author: Petr Pisar <ppisar@redhat.com> - 10.31-7
changelog:
  - Fix checking that a lookbehind assertion has a fixed length if the
    lookbehind assertion is used inside a lookahead assertion
  - Fix parsing VERSION conditions


author: Petr Pisar <ppisar@redhat.com> - 10.31-8
changelog:
  - Fix backtracking atomic groups when they are not separated by something with
    a backtracking point


author: Petr Pisar <ppisar@redhat.com> - 10.31-9
changelog:
  - Recognize all Unicode space characters with /x option in a pattern
    (bug #1617960)
  - Fix changing dynamic options (bug #1617960)
  - Fix autopossessifying a repeated negative class with no characters less than
    256 that is followed by a positive class with only characters less than 255,
    (bug #1617960)
  - Fix autopossessifying a repeated negative class with no characters less than
    256 that is followed by a positive class with only characters less than 256,
    (bug #1617960)


author: Petr Pisar <ppisar@redhat.com> - 10.32-1
changelog:
  - 10.32 bump (bug #1628200)
  - Fix a subject buffer overread in JIT when UTF is disabled and \X or \R has
    a greater than 1 fixed quantifier (bug #1628200)
  - Fix matching a zero-repeated subroutine call at a start of a pattern
    (bug #1628200)
  - Fix heap limit checking overflow in pcre2_dfa_match() (bug #1628200)


author: Ondrej Dubaj <odubaj@redhat.com> - 1.2.11-13
changelog:
  - Added -DDFLTCC parameter to configure to enable 
  - Z hardware-accelerated deflate for s390x architectures (#1659433)


author: Ondrej Dubaj <odubaj@redhat.com> - 1.2.11-16
changelog:
  - Permit a deflateParams() parameter change
  - Another fix for Z hardware-accelerated deflate for s390x architectures
  - according to previous change by upstream


author: Ondrej Dubaj <odubaj@redhat.com> - 1.2.11-17
changelog:
  - Fixed DFLTCC compression level switching issues (#1875492)
  - Enabled HW compression for compression levels 1 through 6 (#1847438)
  - Fixed inflateSyncPoint() bad return value on z15 (#1888930)


author: Lukas Javorsky <ljavorsk@redhat.com> - 1.2.11-19
changelog:
  - Apply IBM patch for compressBound() function
  - Source from https://github.com/madler/zlib/issues/410#issuecomment-947212824
  - Resolves: #2056900


author: Matej Mužila <mmuzila@redhat.com> - 1.2.11-20
changelog:
  - Fix heap-based buffer over-read or buffer overflow in inflate in inflate.c
  - Resolves: CVE-2022-37434


